Splunk Search

user ldap results in my search

chadman
Path Finder

I have an ldap search that pulls computers from active directory group and works great. something like:

|ldapsearch domain=domaingoeshere search=(&(objectClass=computer)(memberof="cn=mygroup,domaindoeshere)) attrs="name"

I have another search that will work great with one computer name that looks like:

sourcetype=patchlog host=servername | eventstats latest(_time) as TIME | where _time = TIME |dedup TIME |table name DateTime Status

How can I make this work with one search for every computer listed in my first ldap search? So instead of having the host=servname it will use the list of computers from my first search. The ldap search will output server names like server1 server2 server3 etc.

0 Karma
1 Solution

gcusello
Esteemed Legend

Hi,
You could use the first search as subsearch of the Second but it Will be very slow.
The best solution is to schedule first search to populate a lookup (first search and the outputlookup Command).
Then use lookup in the second search, something like this
sourcetype=patchlog [ | inputlookup my_lookup.csv | fields host ]
| eventstats latest(_time) as TIME
| where _time = TIME
|dedup TIME
|table name DateTime Status host

Bye.
Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi,
You could use the first search as subsearch of the Second but it Will be very slow.
The best solution is to schedule first search to populate a lookup (first search and the outputlookup Command).
Then use lookup in the second search, something like this
sourcetype=patchlog [ | inputlookup my_lookup.csv | fields host ]
| eventstats latest(_time) as TIME
| where _time = TIME
|dedup TIME
|table name DateTime Status host

Bye.
Giuseppe

chadman
Path Finder

I cant get the output to work. I believe this is because of the multiple search heads we have in our infrastructure. That's why I was trying to do this in one search without using an output.

0 Karma

gcusello
Esteemed Legend

Search heads automatically align lookups,to use ldap search is possible but slow.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...