topic Re: Two condition match - sequential number pid and certain values on associated fields in Splunk Search

Two condition match - sequential number pid and certain values on associated fields

splunkxorsplunk — Sun, 19 Dec 2021 07:45:02 GMT

Hi,
Need help to get following results from the search. all helps will be appreciated.

On the image below, same colors show match cases I would like to get out of my search. Here is the condition I am looking for:

Under the same pid which is all same already on image below.

example -1 ( green on the image) :
pid_of_curl = 990820

pid_of_sh = 990821

If exe = curl and ( pid_of_curl + 1 ) has exe = sh

exe is curl and 990820 + 1 = 990821 = pid in which exe = sh

if exe is either "curl" or "wget" and its pid +1 is equal to ( bash or sh ) pid

Re: Two condition match - sequential number pid and certain values on associated fields

ITWhisperer — Sun, 19 Dec 2021 11:10:20 GMT

Re: Two condition match - sequential number pid and certain values on associated fields

splunkxorsplunk — Mon, 20 Dec 2021 07:10:29 GMT

Hey @ITWhisperer
Thank you so much for spending time and providing this solution.
It gives me the following output

However, I need following matches out of the data set.
logic here is :
1. under the same ppid, (curl OR wget ) and ( bash OR sh ) should be available
2. If #1(above) is true, ((pid _of_curl + 1) OR (pid_of_wget + 1 )) = ( pid_of_sh OR pid_of_bash)

time - ppid - pid - exe
1. time2 - 981804 - 991885, 991885 - curl, bash

2. time2 -981804 - 991940, 991940 - curl, sh

Thanks again.

Re: Two condition match - sequential number pid and certain values on associated fields

ITWhisperer — Mon, 20 Dec 2021 17:31:45 GMT

| makeresults | eval _raw="ppid,pid,exe 981804,991701,ls 981804,991819,rm 981804,990820,curl 981804,990821,sh 981804,991019,ls 981804,991886,bash 981804,991885,curl 981804,990940,bash 981804,991940,curl 981804,990770,ls 981804,990997,sleep 981804,990939,curl 981804,991841,ls 981804,991941,sh" | multikv forceheader=1 | table _time ppid pid exe | where match(exe,"curl|wget|bash|sh") | sort 0 ppid pid | eval curl_wget_time=if(match(exe,"curl|wget"),_time,null()) | eval bash_sh_time=if(match(exe,"bash|sh"),_time,null()) | eval curl_wget_exe=if(match(exe,"curl|wget"),exe,null()) | eval bash_sh_exe=if(match(exe,"bash|sh"),exe,null()) | eval curl_wget_pid=if(match(exe,"curl|wget"),pid,null()) | eval bash_sh_pid=if(match(exe,"bash|sh"),pid,pid+1) | stats values(curl_wget_pid) as curl_wget_pid values(curl_wget_time) as curl_wget_time values(bash_sh_time) as bash_sh_time values(curl_wget_exe) as curl_wget_exe values(bash_sh_exe) as bash_sh_exe by ppid bash_sh_pid | fieldformat curl_wget_time=strftime(curl_wget_time,"%F %T") | fieldformat bash_sh_time=strftime(bash_sh_time,"%F %T")

Re: Two condition match - sequential number pid and certain values on associated fields

splunkxorsplunk — Mon, 20 Dec 2021 17:43:47 GMT

Thanks @ITWhisperer This is what I was exactly looking for, well done.

appreciate your help!

Best,