Splunk Search

Using host tags (or similar) when searching on fields?

Ayn
Legend

I have a number of hosts that have a certain tag on them (let's say "sensitive"). I want to look for account lockout events involving these hosts. Normally this would be simple, just using a query like 'eventtype="winaccountlockout" tag="host::sensitive"' - the twist here is that the actual event occurs not on the hosts themselves but rather on the domain controllers. So, i want to search for account lockout events on the domain controllers that involve the hosts i have that are marked as 'sensitive'.

I was thinking something like 'eventtype="winaccountlockout" Caller_Machine_Name=' where the list is somehow taken from the list of hosts with the "host::sensitive" tag. Is there any way to do that, or solve the problem in another way?

Tags (2)
1 Solution

ftk
Motivator

Use a subsearch as such:

eventtype="winaccountlockout" [search tag::host=sensitive | dedup host | rename host as Caller_Machine_Name | fields Caller_Machine_Name  | format]

Or if you don't want to pass the subsearch results back as the specific field (Caller_Machine_Name) just do

eventtype="winaccountlockout" [search tag::host=sensitive | dedup host | fields host | rename host as search]

View solution in original post

ftk
Motivator

Use a subsearch as such:

eventtype="winaccountlockout" [search tag::host=sensitive | dedup host | rename host as Caller_Machine_Name | fields Caller_Machine_Name  | format]

Or if you don't want to pass the subsearch results back as the specific field (Caller_Machine_Name) just do

eventtype="winaccountlockout" [search tag::host=sensitive | dedup host | fields host | rename host as search]

gkanapathy
Splunk Employee
Splunk Employee

Seems like this would be a good place to consider using lookup tables. Possibly you could even replace the tags with lookup table entries.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...