Splunk Search

Using Python Script in search in the GUI



I am still pretty new to Splunk. I have used the python active_directory module (http://timgolden.me.uk/python/active_directory.html) to run a query and return a list o users from a specific OU. This list changes, so I want to be able to pass in the usernames from the OU to a search.

My question, is there a way to call this python script and grab the output to pass into a search WITHOUT having to run the search itself from Python?

Essentially, I am grabbing a list of vendor accounts who have limited access to some of our systems remotely. What I want to do is dynamically grab a user name list and run a search for their logins on a Windows server. I am hoping to get this going quickly and would prefer using the GUI and report engine from Splunk rather than parse the XML return.

Thanks for any suggestions.


Tags (2)

Splunk Employee
Splunk Employee

This typically is accomplished with a subsearch. Suppose you've defined a command that you can run (from the Web UI or CLI) as the following to give a list of LoginName fields:

| ad | search type=vendor | fields LoginName

Then to parameterize another search by the output of this, you'd search:

sourcetype=... [| ad | search OU=... | fields LoginName]

This search will be expanded to:

sourcetype=... ((LoginName="L1") OR (LoginName="L2") OR ...)

An alternate solution would be to use a scripted lookup instead of a search command. This has the benefit of labeling all logins however you like (say with the OU). Also, if configured properly, you could search by OU transparently:

sourcetype=... OU=...

Splunk Employee
Splunk Employee

Note that the Windows version of Splunk comes with an AD monitoring scripted input. This input lets it load the contents of the AD tree into Splunk so it can be queried via the Splunk search language directly, so you would use a subsearch command like `[ search sourcetype=ActiveDirectory OU=... | eval LoginName=sAMAccountName | fields LoginName ] instead of starting with your AD query script.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...