Splunk Enterprise Security

How can I use an inputlookup command to return results that are not limited to one file?

kokanne
Communicator

I want to use inputlookup to search only a certain set of hosts. These are in a .csv file. I have the query and it's all fine but it's returning results from EVERY host, not just the ones on the list. How can I fix this?

index="wineventlog*" CategoryString="Logon/Logoff Event" 
    [ inputlookup lars_file_computers_zonder_human_inlog.csv 
    | return 115 Workstation_Name=$src ] 
| table Workstation_Name, src, app, action, user
0 Karma

starcher
Influencer

Just use a lookup as a lookup. this presumes the data the value is src and the field in the lookup is Workstation_Name

index="wineventlog*" CategoryString="Logon/Logoff Event" 
| lookup lars_file_computers_zonder_human_inlog.csv Workstation_Name as src OUTPUTNEW Workstation_Name as isFound 
| where isnotnull(isFound)
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...