Using host tags (or similar) when searching on fields?

[Ayn]

I have a number of hosts that have a certain tag on them (let's say "sensitive"). I want to look for account lockout events involving these hosts. Normally this would be simple, just using a query like 'eventtype="winaccountlockout" tag="host::sensitive"' - the twist here is that the actual event occurs not on the hosts themselves but rather on the domain controllers. So, i want to search for account lockout events on the domain controllers that involve the hosts i have that are marked as 'sensitive'.

I was thinking something like 'eventtype="winaccountlockout" Caller_Machine_Name=' where the list is somehow taken from the list of hosts with the "host::sensitive" tag. Is there any way to do that, or solve the problem in another way?

[ftk · Accepted solution]

Use a subsearch as such:

eventtype="winaccountlockout" [search tag::host=sensitive | dedup host | rename host as Caller_Machine_Name | fields Caller_Machine_Name  | format]

Or if you don't want to pass the subsearch results back as the specific field (Caller_Machine_Name) just do

eventtype="winaccountlockout" [search tag::host=sensitive | dedup host | fields host | rename host as search]

[gkanapathy]

Seems like this would be a good place to consider using lookup tables. Possibly you could even replace the tags with lookup table entries.