Getting Data In

Search using multiple variables

bbeltman
New Member

I want to do a search for specific Microsoft event codes, and only for specific users or groups. The search would look something like this:

index=microsoft eventCode=$eventCode user=$user

Basically, the search needs to run for the specified event codes, then narrow it down to only the specific users in a list.

I have the event codes and users in two separate CSV files, would it be possible to do something like this with inputlookup?

Thanks

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Yes, inputlookup would be part of the solution, as part of a subsearch.

Assuming you have your eventcodes in a lookup called "eventcodes.csv" and users in "users.csv", with the field names "eventCode" and "user" at the top, respectively, you do this:

index=microsoft [inputlookup eventcodes.csv] [inputlookup users.csv]

This will result in that the subsearches are expanded into search filters, one for each of all eventcode and user values.

View solution in original post

btt
Path Finder

Hi,
You have two separate CSV files, i think you can just use fields lookup to add fields in your events,
see the procedure in search tutorial manual page 51
after that you can begin searched.

index=microsoft eventCode=$eventCode user=$user
0 Karma

Ayn
Legend

Yes, inputlookup would be part of the solution, as part of a subsearch.

Assuming you have your eventcodes in a lookup called "eventcodes.csv" and users in "users.csv", with the field names "eventCode" and "user" at the top, respectively, you do this:

index=microsoft [inputlookup eventcodes.csv] [inputlookup users.csv]

This will result in that the subsearches are expanded into search filters, one for each of all eventcode and user values.

bbeltman
New Member

Thank you Ayn for the quick answer. It works perfectly.

Now for a bit of added complexity. I've discovered that for one of the event codes, the user field contains a different value than the cn that the others have. However, the cn is included in a different field. Is there a way I can say for any event code matching "1234" search the users in "field1", for everything else search the users in "field2".

Thanks!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...