Splunk Search

How to search Events on Hosts in Inputlookup File?

Kendo213
Communicator

I have a CSV that I've created via ldapsearch, that contains a single column with 'cn' and then a list of servers.

I want to search a sourcetype on each of these servers for a keyword.

I'm having difficulty figuring this out. Any ideas?

0 Karma
1 Solution

tiagofbmm
Influencer

Try this code, it creates and ORed list of the servers in the cn name and passes that to a search.

search [| inputlookup yourlookup.csv | eval host=cn | return host]

Is that what you intend?

View solution in original post

Kendo213
Communicator

I have this, however it's really slow...Is there a faster way to get this to run? Basically we're wanting to narrow down Windows Install events to servers, and not desktops.

index=systems sourcetype=WindowsUpdateLog eventtype=Update_Successful [inputlookup serverlist.csv | table cn | rename cn as host] | stats count by host

Would it be faster to have an inputlookup with workstation names and just a where clause host != workstationname?

0 Karma

tiagofbmm
Influencer

Unfortunately you are searching a non indexed field named eventtype. If you were;t your performance would be x1000 like this

| tstats count where index="systems" AND sourcetype="WindowsUpdateLog" by host |
| search [inputlookup serverlist.csv | rename cn as host | return host]

But unless you start indexing that....

0 Karma

tiagofbmm
Influencer

Your suggestion would worsen things even more. Because you would be doing the statistics over all the events instead of starting by filtering them right away

0 Karma

tiagofbmm
Influencer

Try this code, it creates and ORed list of the servers in the cn name and passes that to a search.

search [| inputlookup yourlookup.csv | eval host=cn | return host]

Is that what you intend?

Kendo213
Communicator

This does return much faster. Could you explain from a technical perspective why that is?

Thanks

0 Karma

tiagofbmm
Influencer

If you just test this part, | inputlookup yourlookup.csv | eval host=cn | return host

You'll see it returns an OR list of the hosts

0 Karma

Kendo213
Communicator

I do see that, however it's only returning the first host in the results. Is that expected?

0 Karma

tiagofbmm
Influencer

Yes I forgot to put the count.

| inputlookup yourlookup.csv | eval host=cn | return host count=10000
0 Karma

Kendo213
Communicator

This seems to cut off about 30 seconds on average.

index=systems sourcetype=WindowsUpdateLog "Installation started" | search [inputlookup serverlist.csv | rename cn as host] | stats count by host

I'm not sure from a Splunk perspective why that is, but it seems to work and run quickly (last run was 2 seconds vs 39)

tiagofbmm
Influencer

Please don't forget to accept the answer and upvote

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...