Splunk Search

How to modify Splunk search only for logon_name users that are inside CSV?

sbatino
Observer

Hello

Hello
I have the following Splunk search syntax which returns me detailed log connection for a all user to the VPN concentrator (F5) in the past 90 days.
I would need to do the same search only for 30 login_name users from csv, how can i build the search syntax?

my actual search for all user with " | search login_name=*  "  is :

 

 

 

index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search login_name=* | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time

 

 

 

 

 

Labels (1)
0 Karma

sbatino
Observer

Query is working now.

index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search [|inputlookup user.csv |fields login_name] | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time

Thanks in advance for your help.

 

0 Karma

jbrocks
Communicator

Hi, you can use inputlookup command for that. If you have your lookup, you can try something like:

index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search login_name=* | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time

| search [|inputlookup mylookup.csv |rename user as login_name |fields login_name]

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well, this search can be improved. Especially with a typical case where you have many users and search just for a small subset of them.

With your search you're listing all events and process all events only to find a handful of them. It would be mkre efficient to first search for the names of the users, regardless of whether they are in the field we want or not (which will filter out a huge part of the data in the index) and only then extract the field and compare with our list of users.

 (btw, that's a bit oversimplified description of how splunk search works - it looks for a given term and then tests if it fits the given field).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...