How to modify Splunk search only for logon_name users that are inside CSV?

[sbatino]

Hello

Hello
I have the following Splunk search syntax which returns me detailed log connection for a all user to the VPN concentrator (F5) in the past 90 days.
I would need to do the same search only for 30 login_name users from csv, how can i build the search syntax?

my actual search for all user with " | search login_name=*  "  is :

index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search login_name=* | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time

[sbatino]

Query is working now.

index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search [|inputlookup user.csv |fields login_name] | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time

Thanks in advance for your help.

[jbrocks]

Hi, you can use inputlookup command for that. If you have your lookup, you can try something like:

index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search login_name=* | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time

| search [|inputlookup mylookup.csv |rename user as login_name |fields login_name]

[PickleRick]

Well, this search can be improved. Especially with a typical case where you have many users and search just for a small subset of them.

With your search you're listing all events and process all events only to find a handful of them. It would be mkre efficient to first search for the names of the users, regardless of whether they are in the field we want or not (which will filter out a huge part of the data in the index) and only then extract the field and compare with our list of users.

 (btw, that's a bit oversimplified description of how splunk search works - it looks for a given term and then tests if it fits the given field).