topic Re: Define condition per timeframe in Splunk Search

Define condition per timeframe

swimena — Tue, 19 Feb 2019 14:09:08 GMT

Hi there,

I hope for some help with a query.

I'm using the following query to get a list of all failed login attempts and so far it works.

index=smth EventCode=4625 Account_Domain="*"
 |fillnull value=NULL
 |eval Account_Name = mvindex(Account_Name,1) 
 |eval LoginType=case(Logon_Type=3,"RPC (not RDP)",Logon_Type=4,"Batch",Logon_Type=5,"Service",Logon_Type=7,"Screen Unlock/Session Resume",Logon_Type=10,"Remote Desktop",Logon_Type=11,"Cached",Logon_Type=9,"New Credentials")
 |stats count by host, Account_Name, LoginType, _time, Account_Domain
 |sort -count

I'd like to check whether it's possible to define additional condition based on predefined timeframes.

For example, I want to list all failed logins for domain RUSSIA for Russia's out of office hours "from 6pm to 7am"
Then the same condition but for ASIA and so on.

So, the condition will be - if failed login domain equals RUSSIA and timeframe equals (predefined value) then show in the report.

Hope it's clear what I want to do 🙂

Re: Define condition per timeframe

somesoni2 — Tue, 29 Sep 2020 23:22:46 GMT

YOu do have the _time value in your final result, so you can extract hour value from it (or time of day), then you can have eval-case to assign the count to different field based on Account_Domain and hour values.

Re: Define condition per timeframe

macadminrohit — Tue, 19 Feb 2019 18:33:01 GMT

you can convert your _time like this | eval TimeOfTheday=strftime(_time,"%R%p") and then again use the case of if conditions to put the time(hour) in the right buckets

Or You could first create epoch time for 6pm and 7am like this | eval StartTime=strptime("18:00","%H:%M") and | eval StartTime=strptime("07:00","%H:%M") and then apply ifelse :

index=smth EventCode=4625 Account_Domain="*" 
| fillnull value=NULL 
| eval Account_Name = mvindex(Account_Name,1) 
| eval LoginType=case(Logon_Type=3,"RPC (not RDP)",Logon_Type=4,"Batch",Logon_Type=5,"Service",Logon_Type=7,"Screen Unlock/Session Resume",Logon_Type=10,"Remote Desktop",Logon_Type=11,"Cached",Logon_Type=9,"New Credentials") 
| stats count by host, Account_Name, LoginType, _time, Account_Domain 
| sort -count 
| eval StartTime=strptime("18:00","%H:%M") 
| eval EndTime=strptime("22:00","%H:%M") | eval Buckets=if(_time>StartTime AND _time<EndTime,"6PM to 7 AM",EverythingElse)

Re: Define condition per timeframe

swimena — Wed, 20 Feb 2019 06:34:27 GMT

Perfect, thank you very much. I set it up for all the domains and it works like a charm.