Splunk Search

How to get Wildcards and Special Characters on lookup table?

Explorer

I'm posting this as everything I have been referencing is from years ago.

I need to relate Users to GPO changes. The problem is that the GPO's EventCode=5136 only reports the distinguishedName (DN). So I exported a GPOGUIDdisplayName.csv file with the following formats.

GUID,displayName
"CN={XXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}CN=Policies,CN=System,DC=xx,DC=xx,DC=xxx,DC=com",Windows 10
CN={XXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}*,Default Domain Policy
CN={XXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}CN=Policies,CN=System,DC=xx,DC=xx,DC=xxx,DC=com,DefaultDomainPolicy2

my search look like this
index="wineventlog" Class=groupPolicyContainer GUID="CN={XXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}" OR GUID="CN={XXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}" source="WinEventLog:Security"
| stats count by user,GUID,time
| lookup GPO
GUID_displayName.csv GUID output displayName
| rename _time as Date
| convert timeformat=%F ctime(Date)
| table Date,user,GUID,displayName

I get everything as expected but the mythical displayName that no matter what format I use seems to always be blank. I figured that the comas on the csv for the FQDN its messing up the file which is that I'm trying to make the wildcard work with the lookup or even if the quotation would. I have looked into this whole transforms thing from past post but I simply don't get it and I'm not totally sure how to access the file as I do everything thru the web GUI. any help its appreciated.

0 Karma
1 Solution

Explorer

Upon a deeper look into my csv file I noticed a formatting difference. My csv was an export of another table generated from my index=msda. I made the table with displayName and distinguishedName. The distinguishedName field has an extra comma. That my Splunk friends solve it. So moral of the story is make sure there are not format errors and the data to match. I was able to spot it by making a smaller sample to test the output. Hope this helps and apologize for the confusion.

View solution in original post

Explorer

Upon a deeper look into my csv file I noticed a formatting difference. My csv was an export of another table generated from my index=msda. I made the table with displayName and distinguishedName. The distinguishedName field has an extra comma. That my Splunk friends solve it. So moral of the story is make sure there are not format errors and the data to match. I was able to spot it by making a smaller sample to test the output. Hope this helps and apologize for the confusion.

View solution in original post

SplunkTrust
SplunkTrust

@rororspec please go ahead and accept your own answer to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Motivator

this is because of | convert timeformat=%F ctime(Date) Could you please remove this line and try out and confirm the response

Explorer

I downvoted this post because no changes to the table

0 Karma

Moderator
Moderator

Hi rororspec

Downvoting should only be reserved for suggestions/solutions that could be potentially harmful to a Splunk environment or goes completely against known best practices. Simply commenting with constructive feedback on the post you are concerned with will be more beneficial for the community to learn from.

Some of the most active members in Answers have helped set the standard of how voting etiquette should work in the Splunk community which distinguishes our culture apart from other Q&A forums. Upvote early and often to give credit where it’s due for high-quality posts, comment where you think feedback needs to be given, and only downvote if something potentially dangerous is suggested or people are just being inappropriate.

If you’re interested in seeing how this voting etiquette was developed, check out this Splunk Answers post: https://answers.splunk.com/answers/244111/proper-etiquette-and-timing-for-voting-here-on-ans.htmlon-...

0 Karma

Explorer

My deepest apologies for any confusion this may have caused. Logic was the only element used to minus the answer as it shows as an answer. I have plus in an attempt to fix the wrong doing. I am eager to keep collaborating with the members on this wealth of knowledge.

0 Karma

Moderator
Moderator

Hi rorospec

Thanks for understanding the guidelines and we are excited to see you contributing to the community.

0 Karma

Explorer

Even without the
| rename time as Date
| convert timeformat=%F ctime(Date)
the table
| stats count by user,GUID,
time
| lookup GPOGUIDdisplayName.csv GUID output displayName
| table user,GUID,displayName

user GUID displayName
XXXXX XXXXXXXX blank

0 Karma

Motivator

hey rororspec,

Did u check permissions for lookup?

0 Karma

Explorer

I created the lookup. permissions are set to red for everyone

0 Karma