topic Re: SPL help - enterprise security in Splunk Cloud Platform

SPL help - enterprise security

iherb_0718 — Tue, 19 Jan 2021 21:22:48 GMT

Trying to modify this default correlation search:

| from inputlookup:access_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90

I want to exclude from this search if the field "user" includes a value that begins with "bob"

Thanks in advance

Re: SPL help - enterprise security

scelikok — Tue, 19 Jan 2021 21:26:21 GMT

Hi @iherb_0718,

Please try this;

| from inputlookup:access_tracker where user LIKE "bob%" | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90

If this reply helps you an upvote is appreciated.

Re: SPL help - enterprise security

iherb_0718 — Tue, 19 Jan 2021 21:30:12 GMT

Sceikok thanks for the quick response. I want to EXCLUDE bob. Therefore what booleon would that be? It won't be "LIKE"

Re: SPL help - enterprise security

iherb_0718 — Tue, 19 Jan 2021 23:08:41 GMT

anyone please?

Re: SPL help - enterprise security

scelikok — Wed, 20 Jan 2021 04:37:01 GMT

Hi @iherb_0718,

You can use below;

| from inputlookup:access_tracker where user!="bob*" | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90

If this reply helps you an upvote is appreciated.

Re: SPL help - enterprise security

iherb_0718 — Wed, 20 Jan 2021 04:45:03 GMT

Sceikok,

that's exactly what I tried but it doesn't work. By the way, there's a PIPE before the WHERE so i'm sure you meant it like this

| from inputlookup:access_tracker | where user!="bob*"
| stats min(firstTime) as firstTime,max(lastTime) as lastTime by user
| where ((now()-'lastTime')/86400)>90

The problem is it doesn't like the asterisk after bob. If I type in an exact user, I can see it gets excluded. If I include the asterik, I see all the "BOBs"

Re: SPL help - enterprise security

scelikok — Wed, 20 Jan 2021 05:15:42 GMT

Hi @iherb_0718,

I didn't notice pipe , normally there is no need from command also but below should work based on your correlation search;

| from inputlookup:access_tracker | where NOT user LIKE "bob%" | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90

| inputlookup access_tracker where user!="bob*" | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90

Both should be ok;

If this reply helps you an upvote is appreciated.