Splunk Enterprise Security

How can I use an inputlookup command to return results that are not limited to one file?

kokanne
Communicator

I want to use inputlookup to search only a certain set of hosts. These are in a .csv file. I have the query and it's all fine but it's returning results from EVERY host, not just the ones on the list. How can I fix this?

index="wineventlog*" CategoryString="Logon/Logoff Event" 
    [ inputlookup lars_file_computers_zonder_human_inlog.csv 
    | return 115 Workstation_Name=$src ] 
| table Workstation_Name, src, app, action, user
0 Karma

starcher
Influencer

Just use a lookup as a lookup. this presumes the data the value is src and the field in the lookup is Workstation_Name

index="wineventlog*" CategoryString="Logon/Logoff Event" 
| lookup lars_file_computers_zonder_human_inlog.csv Workstation_Name as src OUTPUTNEW Workstation_Name as isFound 
| where isnotnull(isFound)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...