Splunk Search

How to write a script to correlate data in a file with an event in Splunk?

amir_thales
Path Finder

Hello,

I want to know if it is possible to do a script which read a file and correlate the data in this file with an event in Splunk.

For example, when I put a USB key in Linux, I have this log:

Jan 31 11:02:51 PFSplunkCentOS5 hald: mounted /dev/sdb1 on behalf of uid 0

and I want to correlate UID 0 with the file /etc/passwd and say uid 0 = root or other user and put root in the event in Splunk like metadata.

Cordially

amir

0 Karma
1 Solution

davpx
Communicator

You don't need a script for this. Take a look at lookups . Write a lookup that has a uid > username correlation and you can run it automatically if needed.

View solution in original post

0 Karma

amir_thales
Path Finder

my problem is solved thank you

0 Karma

amir_thales
Path Finder

Hello davpx,

How can read the /etc/passwd file to correlate the uid with the user because the "lookup" function uses only KML, KMZ and CSV and I want to use the "/etc/passwd" which isn't a KML, KMZ or CSV file.

Thank you
amir

0 Karma

davpx
Communicator

You don't need a script for this. Take a look at lookups . Write a lookup that has a uid > username correlation and you can run it automatically if needed.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...