topic Re: Issues with Case statement in Splunk Search

Issues with Case statement

tgrogan_stack — Tue, 29 Sep 2020 16:47:41 GMT

I have reviewed a number of already answered questions related to case statements but none that seem to address the issue I am having. I am trying to create a table to show AWS CloudTrail events associated with creating, deleting, modifying IAM groups in AWS.

I have no problem with basic details but I am attempting to use a case statement so I can display additional detail for events associated with attaching or detaching a policy to a group, namely the policy that is being attached or detached.

Here is my search string, and the results:

sourcetype="aws:cloudtrail" eventName= *Group* 
| eval Detail=case(eventName == DetachGroupPolicy, requestParameters.policyArn, eventName == AttachGroupPolicy, requestParameters.policyArn, 1=1, "N/A" ) 
| rename requestParameters.groupName as Group, userIdentity.userName as "Performed by" 
| table _time, eventName, Group, Detail, requestParameters.policyArn

RESULTS:
| _time | eventName | Group | Detail | requestParameters.policyArn |
|--------------------------------------------|-----------------------------|------------------|----------|-----------------------------------------------------------|
| 2017-11-14T13:01:30.000-0700 | DeleteGroup | TestGroup | N/A | |
| 2017-11-14T13:01:30.000-0700 | DetachGroupPolicy | TestGroup | N/A | arn:aws:iam::aws:policy/ReadOnlyAccess |
| 2017-11-14T13:01:19.000-0700 | UpdateGroup | tst_grp | N/A | |
| 2017-11-14T13:00:40.000-0700 | AttachGroupPolicy | tst_grp | N/A | arn:aws:iam::aws:policy/ReadOnlyAccess |
| 2017-11-14T13:00:40.000-0700 | CreateGroup | tst_grp | N/A | |

It seems that none of my case comparisons are evaluating to true. I've included the policyArn field to ensure it is actually populated and there are no typos.

Re: Issues with Case statement

HiroshiSatoh — Wed, 15 Nov 2017 04:49:12 GMT

Try this!

| eval Detail=case(eventName == "DetachGroupPolicy", requestParameters.policyArn, eventName == "AttachGroupPolicy", requestParameters.policyArn, 1=1, "N/A" )

Re: Issues with Case statement

kamlesh_vaghela — Wed, 15 Nov 2017 04:58:44 GMT

Can you please try this?

sourcetype="aws:cloudtrail" eventName= *Group* 
| rename requestParameters.policyArn As requestParameters_policyArn,requestParameters.groupName as Group, userIdentity.userName as "Performed by"
| eval Detail=case(eventName=="DetachGroupPolicy" OR eventNam =="AttachGroupPolicy" ,requestParameters_policyArn, 1=1, "N/A" )
| table _time, eventName, Group, Detail, requestParameters_policyArn

Thanks

Re: Issues with Case statement

tgrogan_stack — Wed, 15 Nov 2017 14:56:59 GMT

Renaming requestParameters.policyArn worked. Thank you.

Please post this as an answer so I can mark it as the accepted answer.

Re: Issues with Case statement

tgrogan_stack — Wed, 15 Nov 2017 14:59:20 GMT

This did address the issue of the comparison, but renaming the requestParameters.policyArn field, as suggested by kamlish provided the results I was seeking.

Re: Issues with Case statement

niketn — Tue, 29 Sep 2020 16:44:11 GMT

@tgrogan_stack, please accept @kamlesh_vaghela's answer to mark this question as answered.