topic Re: Search events for multiple samaccountnames in Splunk Search

Search events for multiple samaccountnames

papa — Thu, 01 Oct 2020 22:31:53 GMT

Hello

Cam someone assist on how to do a search like below for multiple samaccountnames ?

ideally from a txt file or CSV ? so to reference the file in the search .

<SamAccountName> EventCode=4624 | table _time,EventCode,src,user,Logon_Type

Re: Search events for multiple samaccountnames

renjith_nair — Fri, 02 Oct 2020 06:12:21 GMT

Try

index="your index" EventCode=4624 [|inputlookup SamAccountName.csv|fields SamAccountName]

This should create an OR'd list of SamAccountName

Re: Search events for multiple samaccountnames

inventsekar — Fri, 02 Oct 2020 08:19:57 GMT

Hi @papa , As @renjith_nair suggested, the lookup is one idea. or if you already ingested the
multiple samaccountnames csv files to splunk, then, you can simply query the multiple files altogether. my apologies if you already know this method.

index=indexName <multiple-SamAccountNames> EventCode=4624 | table _time,EventCode,src,user,Logon_Type