I have a CSV that I've created via ldapsearch, that contains a single column with 'cn' and then a list of servers.
I want to search a sourcetype on each of these servers for a keyword.
I'm having difficulty figuring this out. Any ideas?
Try this code, it creates and ORed list of the servers in the cn name and passes that to a search.
search [| inputlookup yourlookup.csv | eval host=cn | return host]
Is that what you intend?
I have this, however it's really slow...Is there a faster way to get this to run? Basically we're wanting to narrow down Windows Install events to servers, and not desktops.
index=systems sourcetype=WindowsUpdateLog eventtype=Update_Successful [inputlookup serverlist.csv | table cn | rename cn as host] | stats count by host
Would it be faster to have an inputlookup with workstation names and just a where clause host != workstationname?
Unfortunately you are searching a non indexed field named eventtype. If you were;t your performance would be x1000 like this
| tstats count where index="systems" AND sourcetype="WindowsUpdateLog" by host |
| search [inputlookup serverlist.csv | rename cn as host | return host]
But unless you start indexing that....
Your suggestion would worsen things even more. Because you would be doing the statistics over all the events instead of starting by filtering them right away
Try this code, it creates and ORed list of the servers in the cn name and passes that to a search.
search [| inputlookup yourlookup.csv | eval host=cn | return host]
Is that what you intend?
This does return much faster. Could you explain from a technical perspective why that is?
Thanks
If you just test this part, | inputlookup yourlookup.csv | eval host=cn | return host
You'll see it returns an OR list of the hosts
I do see that, however it's only returning the first host in the results. Is that expected?
Yes I forgot to put the count.
| inputlookup yourlookup.csv | eval host=cn | return host count=10000
This seems to cut off about 30 seconds on average.
index=systems sourcetype=WindowsUpdateLog "Installation started" | search [inputlookup serverlist.csv | rename cn as host] | stats count by host
I'm not sure from a Splunk perspective why that is, but it seems to work and run quickly (last run was 2 seconds vs 39)
Please don't forget to accept the answer and upvote