Splunk Search

Search events for multiple samaccountnames

papa
Explorer

Hello 

Cam someone assist on how to do a search like below for multiple samaccountnames ? 

ideally from a txt file or CSV ? so to reference the file in the search . 

 

 

 

<SamAccountName> EventCode=4624 | table _time,EventCode,src,user,Logon_Type

 

 

Labels (1)

inventsekar
SplunkTrust
SplunkTrust

Hi @papa , As @renjith_nair suggested, the lookup is one idea. or if you already ingested the 
multiple samaccountnames csv files to splunk, then, you can simply query the multiple files altogether.  my apologies if you already know this method. 

index=indexName <multiple-SamAccountNames> EventCode=4624 | table _time,EventCode,src,user,Logon_Type
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

renjith_nair
Legend

Try

index="your index" EventCode=4624 [|inputlookup SamAccountName.csv|fields SamAccountName] 

This should create an OR'd list of SamAccountName

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...