topic Re: Return Timestamp from inner and outter search in Splunk Search

Return Timestamp from inner and outter search

shayvdee — Wed, 30 Sep 2020 01:50:26 GMT

Hi,
I am trying to create a search that finds two sequential events. So far I have:

index=wineventlog EventCode=4624 [ search index=wineventlog EventCode=4625 | eval earliest=_time | eval latest=_time+600 | fields earliest latest ComputerName ]

This works and returns successful windows logins that follow a failed login within a 10min period. What I want to do though is return a table that shows the time that the first event occurred and the time that the second triggering event occurred. I tried appending:

| table ComputerName earliest _time

But the earliest field comes back blank when I want that to be showing the time stamp fo the event that matched the subsearch.

Any help would be appreciated. Thanks.

Re: Return Timestamp from inner and outter search

nareshinsvu — Wed, 21 Aug 2019 00:59:05 GMT

Are you trying to match anything from your sub-search? if not, can you try this?

index=wineventlog earliest="-10m@m" latest="now" EventCode=4624 OR EventCode=4625 | fields _time EventCode ComputerName

Re: Return Timestamp from inner and outter search

shayvdee — Wed, 21 Aug 2019 01:29:36 GMT

Hi @nareshinsvu

Thanks for your answer.

I need to match the ComputerName from the subsearch and then use the time from the subsearch to find other events in the same time period.

In the example, I want to find all successful logins over the last week that occur within 10min of a failed login on the same computer.

Thanks.

Re: Return Timestamp from inner and outter search

nareshinsvu — Wed, 21 Aug 2019 02:58:41 GMT

Sorry, I read it wrong. Can you try this? tweak the time format according to your need. Hope this should help now?

index=wineventlog EventCode=4624 OR EventCode=4625 
| eval failed_time=if(EventCode=4625,strftime(_time,"%Y-%m-%dT%H:%M:%S"),"") 
|eval Success_time=if(EventCode=4624,strftime(_time,"%Y-%m-%dT%H:%M:%S"),"") 
| stats list(EventCode) as EventCode range(_time) AS duration values(failed_time) as failed_time values(Success_time) as Success_time BY ComputerName 
| rex field=duration mode=sed "s/\..*$//" 
| where duration <600

Re: Return Timestamp from inner and outter search

shayvdee — Wed, 21 Aug 2019 03:16:31 GMT

Thanks. Not quite working yet, but I think you have pointed me down the right track.

Thanks.