topic Searching notable events in ES to match user field in Splunk Enterprise Security

Searching notable events in ES to match user field

marktechuk — Thu, 29 Aug 2019 18:01:35 GMT

Folks, I'm trying to match a field (user) from a search to see if any previous notable events ES have been generated for that use and output any match.

Cannot seem to get any output

Tried the below:

index=*** sourcetype=*** category="alerttype"| rex field=fieldWithUserID "(?[^:]+$)" | search [ search notable
| fields user dest
| format "(" "(" "OR" ")" "OR" ")"]

Re: Searching notable events in ES to match user field

solarboyz1 — Thu, 29 Aug 2019 18:20:07 GMT

I think you are using the subsearch incorrectly:

The [subsearch] finds the users and uses that list as an OR seperated filter in the main search:

index=notable [ index=YOURINDEX  sourcetype=YOURSOURCETYPE category="alerttype"| rex field=fieldWithUserID "(?<user>[^:]+$)" | fields user | dedupe user ]

Re: Searching notable events in ES to match user field

marktechuk — Tue, 03 Sep 2019 15:47:35 GMT

great thanks, got it to work using your search. 5*