Splunk Search

Using Python Script in search in the GUI



I am still pretty new to Splunk. I have used the python active_directory module (http://timgolden.me.uk/python/active_directory.html) to run a query and return a list o users from a specific OU. This list changes, so I want to be able to pass in the usernames from the OU to a search.

My question, is there a way to call this python script and grab the output to pass into a search WITHOUT having to run the search itself from Python?

Essentially, I am grabbing a list of vendor accounts who have limited access to some of our systems remotely. What I want to do is dynamically grab a user name list and run a search for their logins on a Windows server. I am hoping to get this going quickly and would prefer using the GUI and report engine from Splunk rather than parse the XML return.

Thanks for any suggestions.


Tags (2)

Splunk Employee
Splunk Employee

This typically is accomplished with a subsearch. Suppose you've defined a command that you can run (from the Web UI or CLI) as the following to give a list of LoginName fields:

| ad | search type=vendor | fields LoginName

Then to parameterize another search by the output of this, you'd search:

sourcetype=... [| ad | search OU=... | fields LoginName]

This search will be expanded to:

sourcetype=... ((LoginName="L1") OR (LoginName="L2") OR ...)

An alternate solution would be to use a scripted lookup instead of a search command. This has the benefit of labeling all logins however you like (say with the OU). Also, if configured properly, you could search by OU transparently:

sourcetype=... OU=...

Splunk Employee
Splunk Employee

Note that the Windows version of Splunk comes with an AD monitoring scripted input. This input lets it load the contents of the AD tree into Splunk so it can be queried via the Splunk search language directly, so you would use a subsearch command like `[ search sourcetype=ActiveDirectory OU=... | eval LoginName=sAMAccountName | fields LoginName ] instead of starting with your AD query script.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...