Splunk Search

How to search Events on Hosts in Inputlookup File?

Kendo213
Communicator

I have a CSV that I've created via ldapsearch, that contains a single column with 'cn' and then a list of servers.

I want to search a sourcetype on each of these servers for a keyword.

I'm having difficulty figuring this out. Any ideas?

0 Karma
1 Solution

tiagofbmm
Influencer

Try this code, it creates and ORed list of the servers in the cn name and passes that to a search.

search [| inputlookup yourlookup.csv | eval host=cn | return host]

Is that what you intend?

View solution in original post

Kendo213
Communicator

I have this, however it's really slow...Is there a faster way to get this to run? Basically we're wanting to narrow down Windows Install events to servers, and not desktops.

index=systems sourcetype=WindowsUpdateLog eventtype=Update_Successful [inputlookup serverlist.csv | table cn | rename cn as host] | stats count by host

Would it be faster to have an inputlookup with workstation names and just a where clause host != workstationname?

0 Karma

tiagofbmm
Influencer

Unfortunately you are searching a non indexed field named eventtype. If you were;t your performance would be x1000 like this

| tstats count where index="systems" AND sourcetype="WindowsUpdateLog" by host |
| search [inputlookup serverlist.csv | rename cn as host | return host]

But unless you start indexing that....

0 Karma

tiagofbmm
Influencer

Your suggestion would worsen things even more. Because you would be doing the statistics over all the events instead of starting by filtering them right away

0 Karma

tiagofbmm
Influencer

Try this code, it creates and ORed list of the servers in the cn name and passes that to a search.

search [| inputlookup yourlookup.csv | eval host=cn | return host]

Is that what you intend?

Kendo213
Communicator

This does return much faster. Could you explain from a technical perspective why that is?

Thanks

0 Karma

tiagofbmm
Influencer

If you just test this part, | inputlookup yourlookup.csv | eval host=cn | return host

You'll see it returns an OR list of the hosts

0 Karma

Kendo213
Communicator

I do see that, however it's only returning the first host in the results. Is that expected?

0 Karma

tiagofbmm
Influencer

Yes I forgot to put the count.

| inputlookup yourlookup.csv | eval host=cn | return host count=10000
0 Karma

Kendo213
Communicator

This seems to cut off about 30 seconds on average.

index=systems sourcetype=WindowsUpdateLog "Installation started" | search [inputlookup serverlist.csv | rename cn as host] | stats count by host

I'm not sure from a Splunk perspective why that is, but it seems to work and run quickly (last run was 2 seconds vs 39)

tiagofbmm
Influencer

Please don't forget to accept the answer and upvote

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...