https://community.splunk.com/t5/Splunk-Search/How-to-search-computer-workstation-information-from-Active/m-p/258462#M77431 <P>I want to get all workstations/computers information from active directory and want to know how can I save it OR utilize it [any use case]. </P> <P>My actual requirement is that:<BR /> When I have the total number of workstations in Splunk, then I need to match them with the events of Symantec SEP DB table who have the record of all workstations with SEP agent installed. <BR /> <STRONG>at the end, I should have the workstations who don't have SEP installed</STRONG></P> Tue, 12 Jul 2016 20:04:27 GMT rashid47010 2016-07-12T20:04:27Z https://community.splunk.com/t5/Splunk-Search/How-to-search-computer-workstation-information-from-Active/m-p/258462#M77431 <P>I want to get all workstations/computers information from active directory and want to know how can I save it OR utilize it [any use case]. </P> <P>My actual requirement is that:<BR /> When I have the total number of workstations in Splunk, then I need to match them with the events of Symantec SEP DB table who have the record of all workstations with SEP agent installed. <BR /> <STRONG>at the end, I should have the workstations who don't have SEP installed</STRONG></P> Tue, 12 Jul 2016 20:04:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-computer-workstation-information-from-Active/m-p/258462#M77431 rashid47010 2016-07-12T20:04:27Z https://community.splunk.com/t5/Splunk-Search/How-to-search-computer-workstation-information-from-Active/m-p/258463#M77432 <P>I think through <BR /> <STRONG>Deploy and Use the Splunk Supporting Add-on for Active Directory (SA-LDAPSearch)</STRONG></P> <P>I can achieve as required. Below is the search:</P> <PRE><CODE>| ldapsearch domain=avc search="(&amp;(objectclass=computer))" </CODE></PRE> <P>Please advise on my thoughts</P> Tue, 12 Jul 2016 20:10:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-computer-workstation-information-from-Active/m-p/258463#M77432 rashid47010 2016-07-12T20:10:24Z https://community.splunk.com/t5/Splunk-Search/How-to-search-computer-workstation-information-from-Active/m-p/258464#M77433 <P>Take a look at the <A href="https://splunkbase.splunk.com/app/1680/">Splunk App for Windows Infrastructure</A>. It has all sorts of reports. You could look at the query for Computer Reports and clone that to build your own lookup table using the <CODE>outputlookup</CODE> command</P> <P><A href="http://docs.splunk.com/Documentation/MSApp/1.2.1/Reference/ActiveDirectoryReports">http://docs.splunk.com/Documentation/MSApp/1.2.1/Reference/ActiveDirectoryReports</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup">http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup</A></P> Thu, 14 Jul 2016 22:17:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-computer-workstation-information-from-Active/m-p/258464#M77433 sundareshr 2016-07-14T22:17:02Z