topic Search Events with "\" character in Splunk Search

Search Events with "\" character

jnahuelperez35 — Tue, 29 Sep 2020 19:39:28 GMT

I was making some SQL dashboard and i can't use some variables cause one of them is the kerberos USER that comes like:
"MyDomain\User1"
MyDomain\User2"
MyDomain\User3"
MyDomain\User4"

My search is

index="mssql" sourcetype="mssql:audit"
| eval user=lower(server_principal_name)
| search user="$m_user$"
| table _time name user statement

Where m_user is a dropdown input that populate this way:

index="mssql" sourcetype="mssql:audit" statement!="" statement!="--*" server_principal_name!="*SYSTEM"
| eval user=lower(server_principal_name)
| dedup user

(I use a lower function cause server_principal_name can be "MyDomain\USer1" or ""MyDomain\user1")

The thing is when m_user get's the value (for example) "MyDomain\User1" the search didn't find result, but if i look for "MyDomain\user1" the search finds the events. I was trying to do a eval thing like:

index="mssql" sourcetype="mssql:audit"
    | eval user=lower(server_principal_name)
    | search user="$m_user$"
    | eval user=replace(user,".+\\.+","\\\\")
    | table _time name user statement

without success. Some idea?

Re: Search Events with "\" character

wildcats12 — Mon, 21 May 2018 15:11:58 GMT

In your original search, try changing:
| search user="$m_user$"
to:
| where user="$m_user$"

The where command interprets quoted strings as literals and should do a better job of comparing strings with an escape character.

Re: Search Events with "\" character

niketn — Mon, 21 May 2018 15:35:31 GMT

@jnahuelperez35, search match is not case-sensitive. So there is no need for | eval user=lower(server_principal_name) in Dropdown query or in your search. Also it is better to filter results upfront in the base search when you pull events from raw data, rather than filtering afterwards i.e.

index="mssql" sourcetype="mssql:audit" server_principal_name=$m_user|s$
| table _time name user statement

You need to use token filter to use the token as String. In this case server_principal_name=$m_user|s$
Following is a run anywhere example based on Sample Data and code provided.

<form>
  <label>Dropdown with backslash</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="m_user" searchWhenChanged="true">
      <label>Select User</label>
      <choice value="*">All</choice>
      <fieldForLabel>user</fieldForLabel>
      <fieldForValue>user</fieldForValue>
      <search>
        <query>| makeresults
| fields - _time
| eval user="MyDomain\User1;MyDomain\User2;MyDomain\User3;MyDomain\User4"
| makemv user delim=";"
| mvexpand user
| dedup user</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
|  fields - _time
| eval user="MyDomain\User1;MyDomain\User2;MyDomain\User3;MyDomain\User4"
| makemv user delim=";"
| mvexpand user
| search user=$m_user|s$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Re: Search Events with "\" character

jnahuelperez35 — Mon, 21 May 2018 15:36:04 GMT

thanks for the answer
using where i can search for "mydomain\user" but i can't use with "*" character that means "hey ,give me events of any user".
Any idea?

Re: Search Events with "\" character

wildcats12 — Mon, 21 May 2018 15:46:44 GMT

Yes, you can still use a wildcard search within a where, but the syntax is different. Try the like() function:
| where like(user,"%")

The "%" character is the equivalent of "*" within where, eval, etc when used inside like().