Conditional If statement in search

jcrensh — Mon, 28 Sep 2020 09:48:27 GMT

All,

I have a search that is looking for two specific events. One is for new 2008 OS's and up, the other is 2003 OS's and below.

The problem that I am seeing is that the difference between the two log formats is the mufti-valued Account_Name in the 2008 Os's on up (event id 4624). I can solve the problem by looking for the second value of Account_Name, but when I do that, the results for event id 528 fail to pass the eval test and never show in the results.

It seems that I need a conditional if statement to only eval the Account_Name value if the event id is 4624 present first. I also been toying with the idea of having a count of repeated Account_Name and User_Name values per host (so if user X logs in multiple times, then I would only see one entry per host for that user with a total amount of connections), but not sure where in the search statement that "count" would need to occur.

Below is my current search string. Any help would be greatly appreciated.

source="wineventlog:security" (EventCode="4624" OR EventCode="528") (Logon_Type="2" OR Logon_Type="10") | eval Account_Name=mvindex(Account_Name, -1) | search Account_Name!=scom* AND Account_Name!=esx* | table host, EventCode, User_Name, Account_Name, Source_Network_Address, _time, Logon_Type | sort by host

Re: Conditional If statement in search

bbingham — Thu, 18 Aug 2011 17:04:37 GMT

I think I understand what you are trying to do, just to rephrase, IF event_id=4624, you want account_name to be set to the 2nd value in the multi value field account_name, otherwise you want it to remain the value it's already set to?

something like:

|eval Account_Name=if(EventCode="4624",mvindex(Account_Name, -1),Account_Name)|

topic Conditional If statement in search in Splunk Search

Conditional If statement in search

Re: Conditional If statement in search