I have an ldap search that pulls computers from active directory group and works great. something like:
|ldapsearch domain=domaingoeshere search=(&(objectClass=computer)(memberof="cn=mygroup,domaindoeshere)) attrs="name"
I have another search that will work great with one computer name that looks like:
sourcetype=patchlog host=servername | eventstats latest(_time) as TIME | where _time = TIME |dedup TIME |table name DateTime Status
How can I make this work with one search for every computer listed in my first ldap search? So instead of having the host=servname it will use the list of computers from my first search. The ldap search will output server names like server1 server2 server3 etc.
Hi,
You could use the first search as subsearch of the Second but it Will be very slow.
The best solution is to schedule first search to populate a lookup (first search and the outputlookup Command).
Then use lookup in the second search, something like this
sourcetype=patchlog [ | inputlookup my_lookup.csv | fields host ]
| eventstats latest(_time) as TIME
| where _time = TIME
|dedup TIME
|table name DateTime Status host
Bye.
Giuseppe
Hi,
You could use the first search as subsearch of the Second but it Will be very slow.
The best solution is to schedule first search to populate a lookup (first search and the outputlookup Command).
Then use lookup in the second search, something like this
sourcetype=patchlog [ | inputlookup my_lookup.csv | fields host ]
| eventstats latest(_time) as TIME
| where _time = TIME
|dedup TIME
|table name DateTime Status host
Bye.
Giuseppe
I cant get the output to work. I believe this is because of the multiple search heads we have in our infrastructure. That's why I was trying to do this in one search without using an output.
Search heads automatically align lookups,to use ldap search is possible but slow.
Bye.
Giuseppe