How to search Events on Hosts in Inputlookup File?

[Kendo213]

I have a CSV that I've created via ldapsearch, that contains a single column with 'cn' and then a list of servers.

I want to search a sourcetype on each of these servers for a keyword.

I'm having difficulty figuring this out. Any ideas?

[Kendo213]

I have this, however it's really slow...Is there a faster way to get this to run? Basically we're wanting to narrow down Windows Install events to servers, and not desktops.

index=systems sourcetype=WindowsUpdateLog eventtype=Update_Successful [inputlookup serverlist.csv | table cn | rename cn as host] | stats count by host

Would it be faster to have an inputlookup with workstation names and just a where clause host != workstationname?

[tiagofbmm]

Unfortunately you are searching a non indexed field named eventtype. If you were;t your performance would be x1000 like this

| tstats count where index="systems" AND sourcetype="WindowsUpdateLog" by host |
| search [inputlookup serverlist.csv | rename cn as host | return host]

But unless you start indexing that....

[tiagofbmm]

Your suggestion would worsen things even more. Because you would be doing the statistics over all the events instead of starting by filtering them right away

[tiagofbmm · Accepted solution]

Try this code, it creates and ORed list of the servers in the cn name and passes that to a search.

search [| inputlookup yourlookup.csv | eval host=cn | return host]

Is that what you intend?

[Kendo213]

This does return much faster. Could you explain from a technical perspective why that is?

Thanks

[tiagofbmm]

If you just test this part, | inputlookup yourlookup.csv | eval host=cn | return host

You'll see it returns an OR list of the hosts

[Kendo213]

I do see that, however it's only returning the first host in the results. Is that expected?

[tiagofbmm]

Yes I forgot to put the count.

| inputlookup yourlookup.csv | eval host=cn | return host count=10000

[Kendo213]

This seems to cut off about 30 seconds on average.

index=systems sourcetype=WindowsUpdateLog "Installation started" | search [inputlookup serverlist.csv | rename cn as host] | stats count by host

I'm not sure from a Splunk perspective why that is, but it seems to work and run quickly (last run was 2 seconds vs 39)

[tiagofbmm]

Please don't forget to accept the answer and upvote