https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483693#M7876 <P>Hi @cotyp,<BR /> With <CODE>tstats</CODE> you can use only <CODE>from</CODE>, <CODE>where</CODE> and <CODE>by</CODE> clause arguments. Personally I don't know how can I implement multiple <CODE>if</CODE> statements with these argements <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Thu, 27 Feb 2020 15:55:40 GMT woodentree 2020-02-27T15:55:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483691#M7874 <P>Hello,</P> <P>We'd like to monitor configuration changes on our Linux host. For that we want to detect when in the datamodel <CODE>Auditd</CODE> the field <CODE>name</CODE>is equal to <CODE>/etc/audit/*</CODE>, <CODE>/etc/audisp/*</CODE>, or <CODE>/etc/libaudit.conf</CODE>. Here is our basic search:</P> <PRE><CODE>| tstats `security_content_summariesonly` count from datamodel=Auditd where nodename=Auditd.Path by _time span=1s host Auditd.name | `drop_dm_object_name("Auditd")` </CODE></PRE> <P>The question is how can we implement in the same search 3 conditions below:</P> <PRE><CODE>| where like(name,"%/etc/audit/%") | where like(name,"%/etc/audisp/%") | where name="/etc/libaudit.conf" </CODE></PRE> <P>Logicaly it could be done via <CODE>case</CODE> statement, but we wasn't able to implement it. Do you have any ideas?</P> <P>Thanks for the help.</P> Thu, 27 Feb 2020 13:52:58 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483691#M7874 woodentree 2020-02-27T13:52:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483692#M7875 <P>how about a multiple if statement? <CODE>if(like(name, "etc....%"), "etc",if(like(name, "%audisp%"), "audisp"))</CODE></P> Thu, 27 Feb 2020 15:01:41 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483692#M7875 cotyp 2020-02-27T15:01:41Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483693#M7876 <P>Hi @cotyp,<BR /> With <CODE>tstats</CODE> you can use only <CODE>from</CODE>, <CODE>where</CODE> and <CODE>by</CODE> clause arguments. Personally I don't know how can I implement multiple <CODE>if</CODE> statements with these argements <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Thu, 27 Feb 2020 15:55:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483693#M7876 woodentree 2020-02-27T15:55:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483694#M7877 <P>Try something like </P> <PRE><CODE> | tstats `security_content_summariesonly` count from datamodel=Auditd where nodename=Auditd.Path by _time span=1s host Auditd.name | `drop_dm_object_name("Auditd")` | search name="*/etc/audit/*" OR name="*/etc/audisp/*" OR name="*/etc/libaudit.conf*" </CODE></PRE> Thu, 27 Feb 2020 16:05:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483694#M7877 sumanssah 2020-02-27T16:05:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483695#M7878 <P>Exactly!<BR /> Thanks for the help.</P> Fri, 28 Feb 2020 08:23:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-implement-multiple-where-conditions-with-like-statement/m-p/483695#M7878 woodentree 2020-02-28T08:23:35Z