topic Re: Identifying stale computers on network in Splunk Search

Identifying stale computers on network

Durwood — Tue, 16 Nov 2021 12:12:16 GMT

I am looking to identify specific assets that have not been logged into in over a set time. I am fairly new to all of this and trying to learn in a more hands on way. I was wondering what would be the best way to accomplish this?

I was thinking something like this but I don't think this is right:

EventCode=4624 AND [|inputlookup append=t Computers.csv] NOT [inputlookup append=t Dont_search.csv] | dedup host | table _time,host,user | sort host

Computers.csv - Specific computers that I want to track.

Dont_search.csv - Accounts that I DO NOT want to track.

I am hoping to show all computers on my list regardless of whether they were logged in too. Any help would be greatly appreciated!!!

Re: Identifying stale computers on network

richgalloway — Tue, 16 Nov 2021 13:57:57 GMT

Finding something that is not there is not Splunk's strong suit. See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

Re: Identifying stale computers on network

PickleRick — Tue, 16 Nov 2021 14:19:34 GMT

There are two issues with your search.

1. Your subsearches must return properly named columns. Are you sure that you don't need to do some "| rename"?

2. With subsearches provided this way you only add further conditions to your search. You will still not get any results if there are no events matching the condition set.

If you want to find which hosts didn't send anything, you'd have to append "fake" results from a pre-defined set of hosts, and then - for example - sum them with your found events. Then you'd see which results have zero ocurrences.

A rough idea:

<your search> | stats count by Computername
| append [ | inputlookup myhosts.csv | eval count=0 ]
| stats sum(count) by Computername

Re: Identifying stale computers on network

johnhuang — Tue, 16 Nov 2021 20:13:43 GMT

Assuming that Computers.csv contains a field called "host" and Dont_search.csv contains "user".

Includes domain field which should be more useful.

Re: Identifying stale computers on network

johnhuang — Tue, 16 Nov 2021 20:20:13 GMT

BTW, if your goal is to show real user logons to an interactive session, you should further filter the logon_type. For example:

source=WinEventLog:Security 4624 (EventCode=4624 AND (Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10 OR Logon_Type=11)) [| inputlookup Computers.csv | table host] earliest=-1d@d

Re: Identifying stale computers on network

Durwood — Thu, 18 Nov 2021 16:05:25 GMT

Thank you for the response! I am still having issues with the search excluding the users in the user column of my "Dont_Search.csv". Any ideas? I am very new to the Splunk game so apologies if I am asking something that is a bit elementary.

Re: Identifying stale computers on network

johnhuang — Thu, 18 Nov 2021 23:02:02 GMT

Could you provide a sample of the search output and also Dont_Search.csv?