Splunk Search

How to modify Splunk search only for logon_name users that are inside CSV?

sbatino
Observer

Hello

Hello
I have the following Splunk search syntax which returns me detailed log connection for a all user to the VPN concentrator (F5) in the past 90 days.
I would need to do the same search only for 30 login_name users from csv, how can i build the search syntax?

my actual search for all user with " | search login_name=*  "  is :

 

 

 

index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search login_name=* | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time

 

 

 

 

 

Labels (1)
0 Karma

sbatino
Observer

Query is working now.

index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search [|inputlookup user.csv |fields login_name] | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time

Thanks in advance for your help.

 

0 Karma

jbrocks
Communicator

Hi, you can use inputlookup command for that. If you have your lookup, you can try something like:

index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search login_name=* | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time

| search [|inputlookup mylookup.csv |rename user as login_name |fields login_name]

 

0 Karma

PickleRick
Ultra Champion

Well, this search can be improved. Especially with a typical case where you have many users and search just for a small subset of them.

With your search you're listing all events and process all events only to find a handful of them. It would be mkre efficient to first search for the names of the users, regardless of whether they are in the field we want or not (which will filter out a huge part of the data in the index) and only then extract the field and compare with our list of users.

 (btw, that's a bit oversimplified description of how splunk search works - it looks for a given term and then tests if it fits the given field).

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...