Splunk Enterprise Security

How can I use an inputlookup command to return results that are not limited to one file?

kokanne
Communicator

I want to use inputlookup to search only a certain set of hosts. These are in a .csv file. I have the query and it's all fine but it's returning results from EVERY host, not just the ones on the list. How can I fix this?

index="wineventlog*" CategoryString="Logon/Logoff Event" 
    [ inputlookup lars_file_computers_zonder_human_inlog.csv 
    | return 115 Workstation_Name=$src ] 
| table Workstation_Name, src, app, action, user
0 Karma

starcher
Influencer

Just use a lookup as a lookup. this presumes the data the value is src and the field in the lookup is Workstation_Name

index="wineventlog*" CategoryString="Logon/Logoff Event" 
| lookup lars_file_computers_zonder_human_inlog.csv Workstation_Name as src OUTPUTNEW Workstation_Name as isFound 
| where isnotnull(isFound)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...