Splunk Enterprise Security

How to compare columns in an inputlookup and return results that do not match?

Earenhart
Path Finder

Hello,

I am trying to build a search that takes an inputlookup file that has 2 columns; One is a list of usernames, the second is a list of FQDN's, and generates results when any of the users in the list are seen logging in to any computer other than the one adjacent to it in Column B (their assigned workstations).

For example:
Inputlookupfile.csv
Column A              Column B
Username A         FQDN1
Username B         FQDN2

With this example, my search needs to be able to compare column A with column B, and generate results if say, Username A logs into ANY OTHER computer other than FQDN1 (or even both FQDN1 and FQDN2, but preferably only the one in the adjacent cell).

If there is a simpler way to generate results of a user logging into a machine other than their own, I am all ears. Note: Some users have multiple computers, so I will also need to figure out what the best method is for factoring that in.

0 Karma

somesoni2
Revered Legend

Generally you'd do like this (assuming your indexed data search has a field username and computer_name it them.)

index=foo sourcetpe=bar..your indexed data search
| lookup inputlookupfile.csv "column A" as username OUTPUT "column B" as assigned_computer_name
| where computer_name!=assigned_computer_name

The lookup command will match the username (from indexed data search) with "column A" (from lookup) and add assigned_computer_name (renamed column B from lookup) to search result as a new column. The where clause will just compare computer_name (from indexed data search) with assigned_computer_name to filter results where they don't match.

Earenhart
Path Finder

Thank you somesoni2,

I am in the process of testing this to see if it works. I am not getting errors anymore, but not getting any results either. I will run some test configs and see if I can get some results, and then return back to share what I came up with.

0 Karma

Earenhart
Path Finder

I am not requesting that someone builds a search for me, but am wanting to know if this idea can be accomplished or not. If comparing fields in a csv file is not possible, if anyone knows any other method that might work to accomplish this idea that would be very useful. I felt the need to clarify this since I may not have properly worded my request.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...