Search using multiple variables

[bbeltman]

I want to do a search for specific Microsoft event codes, and only for specific users or groups. The search would look something like this:

index=microsoft eventCode=$eventCode user=$user

Basically, the search needs to run for the specified event codes, then narrow it down to only the specific users in a list.

I have the event codes and users in two separate CSV files, would it be possible to do something like this with inputlookup?

Thanks

[btt]

Hi,
You have two separate CSV files, i think you can just use fields lookup to add fields in your events,
see the procedure in search tutorial manual page 51
after that you can begin searched.

index=microsoft eventCode=$eventCode user=$user

[Ayn · Accepted solution]

Yes, inputlookup would be part of the solution, as part of a subsearch.

Assuming you have your eventcodes in a lookup called "eventcodes.csv" and users in "users.csv", with the field names "eventCode" and "user" at the top, respectively, you do this:

index=microsoft [inputlookup eventcodes.csv] [inputlookup users.csv]

This will result in that the subsearches are expanded into search filters, one for each of all eventcode and user values.

[bbeltman]

Thank you Ayn for the quick answer. It works perfectly.

Now for a bit of added complexity. I've discovered that for one of the event codes, the user field contains a different value than the cn that the others have. However, the cn is included in a different field. Is there a way I can say for any event code matching "1234" search the users in "field1", for everything else search the users in "field2".

Thanks!