Search for certain adjacent events in IIS log

seekay — Thu, 01 Sep 2022 20:53:34 GMT

Greetings,

I've been asked to provide log data for a specific form that has been accessed over a certain time period. As the data are going to leave our organization, I want to filter it down to only the relevant data.

I'm looking for events in which a certain html form has been accessed. I want to display events shortly before and after, that show the same user agent.

I've attempted a few things, but in the latest query I attempted to utilize the map function. I'm not sure why I receive the error "Error in 'map': Did not find value for required attribute 'useragent'. "

index=iis_logs [search "https://example.com/form.html" | eval start=_time-15 | eval stop=_time+30 | eval useragent=_cs_User_Agent | map search="search index=* cs_User_Agent=$useragent$ earliest=$start$ latest=$stop$"]

Edit: When I, for example, put cs_User_Agent=*Mozilla*, there are results surrounding the relevant events. But that is not the data I am looking for.

Re: Search for certain adjacent events in IIS log

richgalloway — Thu, 01 Sep 2022 20:39:28 GMT

Perhaps the _cs_User_Agent field is null, which would lead to the map command trying to search for "cs_User_Agent=". Try putting quotes around $useragent$.

Re: Search for certain adjacent events in IIS log

seekay — Thu, 01 Sep 2022 20:51:23 GMT

Thank you for your response, I tried that, but the error remains the same.

topic Re: Search for certain adjacent events in IIS log in Splunk Search

Search for certain adjacent events in IIS log

Re: Search for certain adjacent events in IIS log

Re: Search for certain adjacent events in IIS log