topic Re: Tricky Search for 2 events in same Index in Splunk Search

Tricky Search for 2 events in same Index

LizAndy123 — Sat, 09 Nov 2024 22:57:09 GMT

So I have an Index with working alerts thanks to your guys help.

I have a question on 2 separate events at the same time.

1st Event : Invalid password provided for user : xxxxxxxx (this is in the Event)

2nd Event : GET /Project/1234/ HTTP/1.1 401 (this is basically letting me know about the first event but what Project they tried to connect.

How would one write to Get the Username of the invalid password and chlorate that with the project at the same time underneath

Example User xxxxxx put in an invalid password for Project 1234.

Thinking it is easier to get my team to write it all in 1 event for another release.

Re: Tricky Search for 2 events in same Index

LizAndy123 — Sat, 09 Nov 2024 23:00:01 GMT

I will add - it is the same index but the 1st event is from one source type and the 2nd event from another source type (just different server logs)

Re: Tricky Search for 2 events in same Index

PickleRick — Sat, 09 Nov 2024 23:06:43 GMT

Correlating on time alone while possible is always tricky. You never know what delay you're gonna get between these two events. And you might get more than just those two events at this particular timestamp. It's best if you either have both those pieces of information within one event or at least they both include some unique identifier so that you can unambiguously connect one with the other.

Re: Tricky Search for 2 events in same Index

yuanliu — Mon, 11 Nov 2024 01:50:17 GMT

In addition to the technical consideration @PickleRick points out, you should make a blunt case to your developers that this is logically impossible unless

there is ever one user accessing your entire Web site with credentials, or
there is a strict mechanism to prevent more than one user to access your Web site during any prescribed time interval.

This, and if code authentication failure is the ONLY reason 401 is returned. (HTTP 401 is for unauthorized access, not an indicator of authentication failure.)

Present the above two logs to your developers, ask them what logic can they use (without Splunk) to tell you why the second event is related to the same user as the second event?

If your logs contain additional identifiable information such as client IP address, there is a better chance for such correlation. But your mock data don't suggest existence of such data.