Splunk Search

Using Python Script in search in the GUI



I am still pretty new to Splunk. I have used the python active_directory module (http://timgolden.me.uk/python/active_directory.html) to run a query and return a list o users from a specific OU. This list changes, so I want to be able to pass in the usernames from the OU to a search.

My question, is there a way to call this python script and grab the output to pass into a search WITHOUT having to run the search itself from Python?

Essentially, I am grabbing a list of vendor accounts who have limited access to some of our systems remotely. What I want to do is dynamically grab a user name list and run a search for their logins on a Windows server. I am hoping to get this going quickly and would prefer using the GUI and report engine from Splunk rather than parse the XML return.

Thanks for any suggestions.


Tags (2)

Splunk Employee
Splunk Employee

This typically is accomplished with a subsearch. Suppose you've defined a command that you can run (from the Web UI or CLI) as the following to give a list of LoginName fields:

| ad | search type=vendor | fields LoginName

Then to parameterize another search by the output of this, you'd search:

sourcetype=... [| ad | search OU=... | fields LoginName]

This search will be expanded to:

sourcetype=... ((LoginName="L1") OR (LoginName="L2") OR ...)

An alternate solution would be to use a scripted lookup instead of a search command. This has the benefit of labeling all logins however you like (say with the OU). Also, if configured properly, you could search by OU transparently:

sourcetype=... OU=...

Splunk Employee
Splunk Employee

Note that the Windows version of Splunk comes with an AD monitoring scripted input. This input lets it load the contents of the AD tree into Splunk so it can be queried via the Splunk search language directly, so you would use a subsearch command like `[ search sourcetype=ActiveDirectory OU=... | eval LoginName=sAMAccountName | fields LoginName ] instead of starting with your AD query script.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...