How to show 2 eventcode fields?

splunkcol — Mon, 10 Jul 2023 16:11:03 GMT

Hi

I need to run this query, I don't know what I'm missing but when I run it the src_ip field doesn't show me anything, I don't know what I'm missing.

Can you help me?

index=main source="WinEventLog:*" EventCode=4688 Creator_Process_Name="*wmiprvse.exe" AND NOT Logon_ID=0x3E7 | table _time, host, user, New_Process_Name, Process_Command_Line | rename host AS Host, user AS Usuario, New_Process_Name AS "Proceso nuevo", Process_Command_Line AS "Comando"

Someone tried to help me and suggested this query but I don't know if it is correct but it doesn't show me the value of the src_ip field.

index=main source="WinEventLog:*" (EventCode=4688 Creator_Process_Name="*wmiprvse.exe" AND NOT Logon_ID=0x3E7) | table _time, host, user, New_Process_Name, Process_Command_Line | rename host AS Host, user AS Usuario, New_Process_Name AS "Proceso nuevo", Process_Command_Line AS "Comando" | join type=inner src_ip [ search index=main source="WinEventLog:*" EventCode=4624 | table EventCode, src_ip ]

Re: Show 2 eventcode fields

inventsekar — Fri, 07 Jul 2023 23:59:19 GMT

index=main source="WinEventLog:*" EventCode=4688 Creator_Process_Name="*wmiprvse.exe" AND NOT Logon_ID=0x3E7 | table _time, host, user, New_Process_Name, Process_Command_Line src_ip

when you run this, do you get src_ip results ah..

Best Regards,
Sekar
my youtube channel for Splunk Newbie Learnings
https://www.youtube.com/@SiemNewbies101/videos

topic Re: Show 2 eventcode fields in Splunk Search

How to show 2 eventcode fields?

Re: Show 2 eventcode fields