Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Search results for specific users in the lookup fi...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
I am trying to list out activity of providing local admin rights other than the authorized user accounts. The list of user authorized user accounts are added in a lookup table called "ITSD.csv" and i am running the below query
index=winendpoint EventCode=4732 Group_Name="Administrators" [|inputlookup ITSD.csv | table User]
The result is not giving me any results, even though there are events of local admin rights provided by users in the list.
Can somebody help ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Chances are, there are other fields in your ITSD.csv file, and it's the table command that you are missing, but here is a step by step debug process that you can use in these situations.
Steps to debug -
1) Find one user ("mysampleuser") in the list who has an event in the time range.
2) Run this search...
index=winendpoint EventCode=4732 Group_Name="Administrators" "mysampleuser"
3) Look at the field list and find the exact spelling of the field name that contains the value "mysampleuser". let's suppose it is called mygrantorfield.
4) Now try this, and it should get the same record.
index=winendpoint EventCode=4732 Group_Name="Administrators" mygrantorfield="mysampleuser"
5) Now try this, and it should get the same record.
index=winendpoint EventCode=4732 Group_Name="Administrators"
[|makeresults | eval User="mysampleuser" | rename User as mygrantorfield | table mygrantorfield]
6) Now try this, and it should get the same record, plus more
index=winendpoint EventCode=4732 Group_Name="Administrators"
[|inputlookup ITSD.csv | rename User as mygrantorfield | table mygrantorfield]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Chances are, there are other fields in your ITSD.csv file, and it's the table command that you are missing, but here is a step by step debug process that you can use in these situations.
Steps to debug -
1) Find one user ("mysampleuser") in the list who has an event in the time range.
2) Run this search...
index=winendpoint EventCode=4732 Group_Name="Administrators" "mysampleuser"
3) Look at the field list and find the exact spelling of the field name that contains the value "mysampleuser". let's suppose it is called mygrantorfield.
4) Now try this, and it should get the same record.
index=winendpoint EventCode=4732 Group_Name="Administrators" mygrantorfield="mysampleuser"
5) Now try this, and it should get the same record.
index=winendpoint EventCode=4732 Group_Name="Administrators"
[|makeresults | eval User="mysampleuser" | rename User as mygrantorfield | table mygrantorfield]
6) Now try this, and it should get the same record, plus more
index=winendpoint EventCode=4732 Group_Name="Administrators"
[|inputlookup ITSD.csv | rename User as mygrantorfield | table mygrantorfield]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My guess is that you need to rename User to user (fieldnames are case sensitive) and probably should use format so:
index=winendpoint EventCode=4732 Group_Name="Administrators" [|inputlookup ITSD.csv | fields User|rename User AS user|format]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Tried this as well. But no Luck. It seems that something is missing. I have given complete read and write permission to all user roles in the search app. But still it's not working.
When i try to load the lookup table using the below query, it's working fine
|inputlookup ITSD.csv | table User
The table has just the following entries
User
ABC
XYZ
DEF
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, I guess I don't understand the issue. One thing to think of if you think it is a permissions issue is that lookup table files can have permissions set to private as well. Probably worth a look >
Settings > Lookups > Lookup table files
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
