Splunk Enterprise Security

How can I use an inputlookup command to return results that are not limited to one file?

kokanne
Communicator

I want to use inputlookup to search only a certain set of hosts. These are in a .csv file. I have the query and it's all fine but it's returning results from EVERY host, not just the ones on the list. How can I fix this?

index="wineventlog*" CategoryString="Logon/Logoff Event" 
    [ inputlookup lars_file_computers_zonder_human_inlog.csv 
    | return 115 Workstation_Name=$src ] 
| table Workstation_Name, src, app, action, user
0 Karma

starcher
Influencer

Just use a lookup as a lookup. this presumes the data the value is src and the field in the lookup is Workstation_Name

index="wineventlog*" CategoryString="Logon/Logoff Event" 
| lookup lars_file_computers_zonder_human_inlog.csv Workstation_Name as src OUTPUTNEW Workstation_Name as isFound 
| where isnotnull(isFound)
0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...