About plaid_blanket

plaid_blanket · ‎02-21-2024

And same in 2024. Thank you!

plaid_blanket · ‎05-01-2023

Thanks, @acharlieh , this is awesome. Exactly what I needed, fed to me on a spoon. Really appreciate the time you saved me.

plaid_blanket · ‎02-01-2023

Nope, no luck. If it helps, doing the lookup DOES do something, because this index=windows_client source="WinEventLog:PowerShell" Sid=S-1-2-34-56789012-345678901-234567890-123456 | eval objectSid="this has content" | lookup AD_Obj_User objectSid AS Sid OUTPUT objectSid | table OU Sid objectSid returns a table that has the Sid column populated, but the other two columns blank (i.e., the lookup overwrites the "this has content" stuff in objectSid).

plaid_blanket · ‎02-01-2023

I've got a kvStore lookup, AD_Obj_user, defined with fields objectSid, OU, sAMAccountName, and others. It has case-insensitive matching. I've got events that contain the field Sid. I want to lookup the sAMAccountName and automate the lookup, but right now not even the manual lookup works. This works: | inputlookup AD_Obj_User where objectSid=S-1-2-34-56789012-345678901-234567890-123456 | table objectSid sAMAccountName OU but this does not work: index=windows_client source="WinEventLog:PowerShell" Sid=S-1-2-34-56789012-345678901-234567890-123456 | lookup AD_Obj_User objectSid AS Sid | table OU Sid I can do the lookup successfully, manually, by using this: index=windows_client source="WinEventLog:PowerShell" Sid=S-1-2-34-56789012-345678901-234567890-123456 | eval objectSid=Sid | join type=left objectSid [| inputlookup AD_Obj_User | table objectSid sAMAccountName OU] | eval User=sAMAccountName | fields - sAMAccountName but it won't get me towards automating the lookup. Any ideas? I'm stumped.

plaid_blanket · ‎11-22-2021

Looks like as of Feb 2021, it supports python 3. https://splunkbase.splunk.com/app/2734/

Posts	5
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎11-22-2021

Online Status	Offline
Date Last Visited	‎02-21-2024 01:51 PM

Why doesn't kvStore lookup work, but join does?

Re: Pie Chart data labels

Re: Get all imported_roles for a role

Re: Why doesn't kvStore lookup work, but join does...

Why doesn't kvStore lookup work, but join does?

Re: URL Toolbox