topic Re: Help to Write the Custom Query in Splunk Search

Help to Write the Custom Query

sumit29 — Mon, 28 Sep 2020 20:00:49 GMT

Dear Experts,

I am creating the custom search in ES app ,

| tstats allow_old_summaries=true dc(Authentication.src) as "Source",dc(Authentication.user) as "User" from datamodel=Authentication where nodename=Authentication.Successful_Authentication by "Authentication.user","Authentication.src" | rename "Authentication.user" as "User","Authentication.src" as "Source" | Where User="x" AND Source!="a" AND Source!="b" AND Source!="c"

Result : Above query is not working as expected.

I have a User=x which can be authenticated from 3 source.

I need to create the alert if user login from other than this 3 source , I should get the alert . Kindly help to enhance the query.

Re: Help to Write the Custom Query

rphillips_splk — Fri, 22 May 2015 17:07:13 GMT

try backing out of your search and respond with where it is failing. For example take off:
| Where User="x" AND Source!="a" AND Source!="b" AND Source!="c"

what are the results of the search at that point? If it still fails take off more of the search so we can see what works and what doesn't.

as a first guess I would try replacing

| Where User="x" AND Source!="a" AND Source!="b" AND Source!="c"

with

| search User="x" Source!="a" OR Source!="b" OR Source!="c"

Re: Help to Write the Custom Query

woodcock — Sun, 24 May 2015 04:16:26 GMT

The AND -> OR is definitely wrong.

Re: Help to Write the Custom Query

sumit29 — Sun, 24 May 2015 04:27:06 GMT

Thanks rphillips,

I haven't tried the query as its weekend .will try on Monday

@woodcock - can u extend ur help in writing the query .Thanks

Re: Help to Write the Custom Query

woodcock — Sun, 24 May 2015 04:57:13 GMT

Other than that Where should be where, your search looks fine to me (assuming, as @rphillips_splunk said, the stuff before where is OK)