Getting Data In

Can I get my search of Ironport logs to look up the username in Active Directory?

AlexD
Explorer

I've got a search of our Ironport web access logs that produces a list of cs_usernames (as well as other details), and with a small regex, these usernames match values in the sAMAccountName field in Active Directory records (which we're also indexing). What I'd like to do is replace the Ironport cs_username fields in my results with the AD field displayName from a search that matches the cs_username to sAMAccountName.

Any help would be greatly appreciated!

0 Karma
1 Solution

Ayn
Legend

Yes! Use lookups (http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups ).

One way would be to create a dynamic lookup script that will query Active Directory in realtime when the search results are loaded. This could be slow and resource consuming regarding on how many lookups have to be performed when you issue the search. YMMV.

Another way would be to extract the AD users into a csv file and have Splunk use that as a static lookup. This won't have the potential problems outlined in the previous solution, but you would obviously need to keep this csv file updated so that it actually contains all the current AD users.

View solution in original post

Ayn
Legend

Yes! Use lookups (http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups ).

One way would be to create a dynamic lookup script that will query Active Directory in realtime when the search results are loaded. This could be slow and resource consuming regarding on how many lookups have to be performed when you issue the search. YMMV.

Another way would be to extract the AD users into a csv file and have Splunk use that as a static lookup. This won't have the potential problems outlined in the previous solution, but you would obviously need to keep this csv file updated so that it actually contains all the current AD users.

AlexD
Explorer

Thanks, that's just what I needed.

I tested the static lookup with some sample AD data on a simple query and it worked well, so I'll try a full export and run it on a larger search and if all goes well I'll just update the CSV as needed.

The dynamic lookup is a desired solution, but I'll have to find some time to look into this, as I know nothing about python scripting.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...