I recently had to a do a 5 minute presentation on my Splunk ES course, I chose lookups as the subject, so I thought I ‘d add this to my blog.
“lookups NOT hookups” (was my presentation title)
Anyway, this simple article will show you how to set up a simple lookup within Splunk.
The search is for an Windows event id which runs a lookup function on the filed name “Account_Name” and if a match is found in the lookpup, the fields specified in the OUTPUT function will be displayed in the fields display in Splunk, from this you can create dashboards tables etcs.
Time to get some data in!!! –
Configure some UF’s on Windows servers, and ingest security logs – see the security essentials app https://splunkbase.splunk.com/app/3435/ it will help you get the data in.
Tasks: (After Ingesting the Windows logs)
a. Run a search and check the fields – note the fields of interest
index=wineventlog (type your index details)
Look for the Account_Name this field contains the windows domain name and is of interest.
b. Create lookup csv file (notice the Account_Name field), this must match the
csv file headers.
Lookup Example csv file
Account_Name,first_name,last_name,account_status
donna,donna,kebab,Disabled
user1,user1,lazy,Enabled
wendy,wendy,moss,Enabled
jane,jane,simms,Enabled
instructor,instructor,splunk,Enabled
space,space,cadet,Enabled
Add the csv file to Splunk / lookups / define the lookup name , then run the command to see the data from the csv file
| inputslookup <csv filename> (If you can see the data move onto to the next step)
c. Run the below search, which will add names once its Account_Name is matched and is disabled.
Before you run the serach disable one of the accounts in the csv file and the event 4738 should be generated in Windows(im using this as an example)
index=wineventlog sourcetype=WinEventLog:Security EventCode=4738 “Account Disabled”
| lookup dc_ad_accounts Account_Name OUTPUT first_name, last_name, account_status
you should see new fields first_name and last_name and they should contain the values frojm the csv file
Now Add a table / dashboard
index=wineventlog sourcetype=WinEventLog:Security EventCode=4738 “Account Disabled”
| lookup dc_ad_accounts Account_Name OUTPUT first_name, last_name, account_status
| table _time, first_name, last_name, account_status
Done!
iOpsMon 