I have a list of 140,000 server names that I need to pull information on. I have a DB query that allows me to do this, but I'm struggling with being able to search for all 140,000 server names. The search goes : | db query "SELECT D.node as 'Server' ...... FROM detail_eposccm AS D left outer join remedyimport AS R ON D.node = R.NODE Where d.node='abcd' OR d.node='qrst' OR d.node='iuty'" When I had a smaller list I would just manually list out the server names using OR however that won't work for this list of 100,000 plus. I've created a csv file with the ServerName as column 1 and full d.node path (d.node='servername') in column 2, and have saved it as a lookup table inside the search app. However I can't get the query to pick up the input table for some reason. any advice would be greatly appreciated! ... View more

Hello, I am trying to onboard an ActiveRoles server, however it doesn't seem that I'm configuring my inputs.conf appropriately. The 'full name' in Event Viewer properties for the server reads, "EDM Server", and the file path reads, \Winevt\Logs\EDM Server.evtx. any ideas on what I should name the monitoring stanza so I can pick up these logs? Thank you! PS: At the top of the Properties files it reads "Type: Administrative"- not sure if this matters. ... View more

Hi All, I am using a transaction command to group log data by Account Name. I'm particularly interested in any account names that occur for 2 separate events at the same time. I've been able to get this through a transaction command, however the processing time is just way too long. My search is: index=xxx sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:security" (EventCode=4771 AND "Audit Failure") OR "EventCode=4740" | transaction Account_name startswith=eval(EventCode="4740") endswith=eval(EventCode="4771") maxspan=1m Would like to see a table showing Account_Name, ComputerName, CallerName,ClientAddress. The first three are available through EventCode=4740, however it does not give me ClientAddress. The 4771 event (occurred at the same time, for same user) will have ClientAddress. index=xxx sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:security" (EventCode=4771 AND "Audit Failure") OR "EventCode=4740" | transaction Account_name startswith=eval(EventCode="4740") endswith=eval(EventCode="4771") maxspan=1m | table DATE/TIME user Account_Domain ComputerName Caller_Computer_Name Client_Address The above satisfies what I need but are there alternatives? ... View more

Hi All, In my scenario, I have a batch of events that are for a particular Event Code, sorted by time. The fields included in this Event are Account Name, Computer Name, and Account Domain. There is a separate batch of events for another Event Code, sorted by time. And these fields include Account Name, Computer Name and Client Address. Basically I would like to run a search for the 1st scenario, however I'd also like to include the corresponding Client Address from the 2nd scenario, if the Account Name matches (for events that occurred at relatively the same time) Any ideas or tips on how to go about this would be greatly appreciated! ... View more