topic How to filter two different actions events based on a common field in both in Splunk Search

How to filter two different actions events based on a common field in both

massumtaqi — Fri, 10 May 2019 19:10:44 GMT

if an action 1 triggers one event of common field=A and action 2 triggers ten events of common field= A, B or C. How do i identify and filter the Acton 1 and 2 separately?

Re: How to filter two different actions events based on a common field in both

woodcock — Fri, 10 May 2019 20:01:50 GMT

Show sample events and mockup of desired final output.

Re: How to filter two different actions events based on a common field in both

massumtaqi — Fri, 10 May 2019 20:34:10 GMT

Action one triggers 1 event :

Logon_Type
3
_time
2019-05-10T14:38:12.000-0400

Action two triggers 12 concurrent events :

Logon_Type
3
3
3
3
3
3
3
3
3
3
10
3

_time
2019-05-10T14:32:13.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:11.000-0400
2019-05-10T14:32:11.000-0400
2019-05-10T14:32:10.000-0400

I want to see first one only

Re: How to filter two different actions events based on a common field in both

woodcock — Sat, 11 May 2019 05:15:41 GMT

Like this (or similar):

((index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo") OR (index="YouShouldAlwaysSpecifyOtherIndex" AND sourcetype="AndOtherSourcetypeToo")) AND Logon_Type="*"
| stats latest(_raw) AS _raw count dc(sourcetype) AS sourcetypeCount BY host
| where count>1 OR sourcetypeCount>1

Re: How to filter two different actions events based on a common field in both

massumtaqi — Sat, 11 May 2019 21:24:32 GMT

EventCode=4624
| rex "(?ms)Logon Type:...(?<Logon_Type>\w+)"
| rex "(?ms)New Logon:\s+Security ID:..(?<Login_Security_ID>[AEW]+.\w+.\w+)"
| where (like (Login_Security_ID,"%mtaqi.a%"))
| where Logon_GUID!="{00000000-0000-0000-0000-000000000000}"

This is my code above that shows all 13 events for both actions . what do i do to see only event 1 of logon_type 3 caused by first action ?

The code you provided also show all 13 events

Re: How to filter two different actions events based on a common field in both

woodcock — Sat, 06 Jul 2019 20:11:42 GMT

First of all, your sample events don't make sense: your "first event" has a timestamp after all of the other events that "it caused" and your 12 events only have 11 timestamps listed (worst of all, the one that is not there is the most important one, the one that you desire). You should install the Windows TA so that your field extractions are automatic. I say this all the time: sow us your sample events (you were close but not all the way there), and a mockup of your desired final output. Then we can help.