All Apps and Add-ons

Why are inputlookup searches resulting in double domain names?

pmac22
Path Finder

Hello, I have these weird search results in the Splunk App for Windows Infrastructure and Splunk App for Microsoft Exchange where the src_nt_domain results in double my domain name. For example, my domain is 'abc' the results for the src_nt_domain field are ABC ABC. So I don't know if the inputlookup is causing this or if some ldap.conf file is messed up. specifically, the search is in the Active Directory tab of the Exchange app, then Users, then Anonymous and the search is from the Logons from Multiple Workstations widget/inline search.

Here's the search ...

eventtype=msad-successful-user-logons NOT (user="SYSTEM" OR user="LOCAL SERVICE" OR user="NETWORK SERVICE" OR src_nt_domain="-") (host="*") | lookup SiteInfo host | fields * | search (Logon_Type=2 OR Logon_Type=3 OR Logon_Type=10) src_ip!="-" | join src_ip [|inputlookup tHostInfo | table src_ip,src_host,src_nt_domain] | eval src_host=if(src_ip=="127.0.0.1" OR src_ip=="-",upper(host),src_host) | eval src_host=src_nt_domain."\\".src_host | stats dc(src_host) as hostcount,values(src_host) as Workstations by user,src_nt_domain | where hostcount>1 | search user="Wiley_Coyote" | sort user,src_nt_domain

which results in
User = Wiley_Coyote / src_nt_domain = ABC ABC / Hostcount = 2 / Workstations = ABC ABC\Road_Runner and ABC ABC\Bugs_Bunny

The ldap.conf file in the ldapsearch app seems to be configured properly to my domain and alias and baseDN...

Any suggestions?
Thanks!

0 Karma

paulbannister
Communicator

Hi There, just as a thought is there any reason the information in the lookup can't be setup as an automatic lookup? Also does the information exist anywhere else within the data to which you are joining the inputlookup to?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...