Splunk Enterprise Security

How to compare columns in an inputlookup and return results that do not match?

Explorer

Hello,

I am trying to build a search that takes an inputlookup file that has 2 columns; One is a list of usernames, the second is a list of FQDN's, and generates results when any of the users in the list are seen logging in to any computer other than the one adjacent to it in Column B (their assigned workstations).

For example:
Inputlookupfile.csv
Column A              Column B
Username A         FQDN1
Username B         FQDN2

With this example, my search needs to be able to compare column A with column B, and generate results if say, Username A logs into ANY OTHER computer other than FQDN1 (or even both FQDN1 and FQDN2, but preferably only the one in the adjacent cell).

If there is a simpler way to generate results of a user logging into a machine other than their own, I am all ears. Note: Some users have multiple computers, so I will also need to figure out what the best method is for factoring that in.

0 Karma

Revered Legend

Generally you'd do like this (assuming your indexed data search has a field username and computer_name it them.)

index=foo sourcetpe=bar..your indexed data search
| lookup inputlookupfile.csv "column A" as username OUTPUT "column B" as assigned_computer_name
| where computer_name!=assigned_computer_name

The lookup command will match the username (from indexed data search) with "column A" (from lookup) and add assigned_computer_name (renamed column B from lookup) to search result as a new column. The where clause will just compare computer_name (from indexed data search) with assigned_computer_name to filter results where they don't match.

Explorer

Thank you somesoni2,

I am in the process of testing this to see if it works. I am not getting errors anymore, but not getting any results either. I will run some test configs and see if I can get some results, and then return back to share what I came up with.

0 Karma

Explorer

I am not requesting that someone builds a search for me, but am wanting to know if this idea can be accomplished or not. If comparing fields in a csv file is not possible, if anyone knows any other method that might work to accomplish this idea that would be very useful. I felt the need to clarify this since I may not have properly worded my request.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!