I want to get all workstations/computers information from active directory and want to know how can I save it OR utilize it [any use case].
My actual requirement is that:
When I have the total number of workstations in Splunk, then I need to match them with the events of Symantec SEP DB table who have the record of all workstations with SEP agent installed.
at the end, I should have the workstations who don't have SEP installed
Take a look at the Splunk App for Windows Infrastructure. It has all sorts of reports. You could look at the query for Computer Reports and clone that to build your own lookup table using the outputlookup
command
http://docs.splunk.com/Documentation/MSApp/1.2.1/Reference/ActiveDirectoryReports
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup
I think through
Deploy and Use the Splunk Supporting Add-on for Active Directory (SA-LDAPSearch)
I can achieve as required. Below is the search:
| ldapsearch domain=avc search="(&(objectclass=computer))"
Please advise on my thoughts