Skip to main content
Question

Find Duplicate Computer Records with Splunk

  • February 4, 2020
  • 1 reply
  • 0 views

Forum|alt.badge.img+7

It pays to stay at JNUC until the very end. The last session at JNUC 2019 gave me the inspiration to finally solve the issue of finding duplicate computer serial numbers using Splunk.

This is extremely helpful in finding computer records after a computer has had a mainboard replaced by Apple. The Serial Number is the same, but a new JSS Computer ID is created.

  1. Download the .tgz here:
    https://www.splunk.com/en_us/download/splunk-enterprise.html#tabs/macos
    *The .dmg didn't seem to install properly for me, but the .tgz did.

  2. Create a read-only user in JamfPro that Splunk can use to access an Advanced Search.

  3. Create an Advanced Search where
    Criteria "Managed Is Managed" or "Managed Is Unmanaged".
    Display: Serial Number, Computer Name, and JSS Computer ID.

  4. Install the Jamf Pro Add-On and configure it with your instance and the Advanced Search:
    https://splunkbase.splunk.com/app/4729/

  5. Use this code and set a 1-hour Window:

sourcetype="jamfmodularinput" 
| stats count, values(computer.Computer_Name), values(computer.JSS_Computer_ID) by "computer.Serial_Number"
| sort-count 
| where count>1

1 reply

david_edgar
Forum|alt.badge.img+7
  • Contributor
  • 11 replies
  • February 6, 2024

I wonder if anyone else has run into this same scenario but has been able to utilize customer searches or attribute extensions. We've started to find these ghost accounts present due to mainboard changes, and it's getting rather...annoying.


Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings