https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464455#M6872 <P>Thank you so much for your support. It is working perfectly.</P> Sun, 24 May 2020 16:20:12 GMT mohanrajm 2020-05-24T16:20:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464451#M6868 <P>Hi Guys,</P> <P>I'm new to Splunk and trying to achieve the below requirements. Please help me.</P> <P>If the system name is not started with "AUH" and if it's part of "corporate_VPN" then give the result in a table with the user name, computer name, and group name. user field has a common value between these 2 log lines but system name is from another log line.</P> <P>2020-05-21 13:47:18 System4.Info 10.10.10.1 date=2020-05-21 time=13:47:45 devname="FW01-T1" devid="FG201" logid="39949" type="event" subtype="vpn" level="information" logdesc="SSL VPN statistics" action="tunnel-stats" tunneltype="ssl-tunnel" <STRONG>user="testuser"</STRONG> <STRONG>group="corporate_VPN"</STRONG> msg="SSL tunnel statistics"</P> <P>2020-05-21 13:47:51 System4.Info 10.10.10.1 date=2020-05-21 time=13:47:51 devname="FW01-T1" devid="FG201" logid="45057" type="event" subtype="endpoint" level="information" logdesc="FortiClient connection added" action="add" status="success" connection_type="sslvpn" count=1 <STRONG>user="testuser"</STRONG> <STRONG>systemname="AUHWIN01"</STRONG> msg="Add a FortiClient Connection."</P> <P>Regards,<BR />Mohan</P> Sun, 07 Jun 2020 15:55:03 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464451#M6868 mohanrajm 2020-06-07T15:55:03Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464452#M6869 <P>This may help, but the results may be not great if there are multiple sets of events for the same user.</P> <PRE><CODE>index=foo | stats values(*) as * by user | where match(group, "corporate_VPN") AND NOT match(systemname, "(?i)AUH.*") </CODE></PRE> Sun, 24 May 2020 14:08:29 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464452#M6869 richgalloway 2020-05-24T14:08:29Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464453#M6870 <P>Thanks for your quick reply. I'm getting the unexpected results but due to case-sensitivity, I guess. how to match the system name even if it's case sensitive or not?</P> <P>For Example:<BR /> AUH<BR /> auh<BR /> Auh</P> Sun, 24 May 2020 15:41:23 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464453#M6870 mohanrajm 2020-05-24T15:41:23Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464454#M6871 <P>Use the case-insensitive flag <CODE>(?i)</CODE> in the regular expression. I've updated my answer to include it.</P> Sun, 24 May 2020 15:57:50 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464454#M6871 richgalloway 2020-05-24T15:57:50Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464455#M6872 <P>Thank you so much for your support. It is working perfectly.</P> Sun, 24 May 2020 16:20:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Match-2-log-lines-using-common-value-and-compare/m-p/464455#M6872 mohanrajm 2020-05-24T16:20:12Z