Splunk Enterprise Security

How can I use an inputlookup command to return results that are not limited to one file?

kokanne
Communicator

I want to use inputlookup to search only a certain set of hosts. These are in a .csv file. I have the query and it's all fine but it's returning results from EVERY host, not just the ones on the list. How can I fix this?

index="wineventlog*" CategoryString="Logon/Logoff Event" 
    [ inputlookup lars_file_computers_zonder_human_inlog.csv 
    | return 115 Workstation_Name=$src ] 
| table Workstation_Name, src, app, action, user
0 Karma

starcher
Influencer

Just use a lookup as a lookup. this presumes the data the value is src and the field in the lookup is Workstation_Name

index="wineventlog*" CategoryString="Logon/Logoff Event" 
| lookup lars_file_computers_zonder_human_inlog.csv Workstation_Name as src OUTPUTNEW Workstation_Name as isFound 
| where isnotnull(isFound)
0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...