topic Re: Search- Removed/Added in Splunk Search

Search- Removed/Added

Michael_Schyma1 — Fri, 20 Jul 2012 17:19:50 GMT

index="Server" ( CategoryString="Account Management" OR TaskCategory="Security Group Management" ) (Message="Security Enabled*" OR Message="A member was added to a*" OR Message="A member was removed from a*") ("EventCode=624" OR "EventCode=630" OR "EventCode=4720" OR "Eventcode=4726")  | eval caller = if(isnull(Account_Name), Caller_User_Name, mvindex(Account_Name,0)) | eval member = if(isnull(Account_Name), Member_Name, mvindex(Account_Name,1)) | eval group = if(isnull(Target_Account_Name), Group_Name, Target_Account_Name) | rex field=_raw "CN=(?<cname>.+?)," | rex field=_raw "Message=A security-enabled .* was (?<action>.+?)\." | rex field=_raw "was (?<details>\S+)"| table _time host caller details cname| rename _time AS Date/Time cname AS User group AS Group caller AS "Initiator" name AS "Description" host AS "DC" Security_ID AS "Initiator" details AS Action | convert timeformat="%m/%d/%Y %H:%M:%S %p" ctime(Date/Time)

I can not get the removed field to work, when i put the proper event codes that I want. Does anyone have any suggestions?

Re: Search- Removed/Added

Ayn — Fri, 20 Jul 2012 19:31:31 GMT

It's kind of hard to read your questions - it's a search consisting of 10 dense lines, followed by a very short text about something that does not work. Please include more detail on your use-case, what the desired outcome is, what results you are getting instead and any other details that might help us help you.

Re: Search- Removed/Added

MHibbin — Sat, 21 Jul 2012 15:47:11 GMT

Agreed... where is your "removed" field meant to be used, the string "removed" is only mentioned once in your search syntax, and that is part of the initial search command.

Re: Search- Removed/Added

chrismorris — Sun, 22 Jul 2012 20:30:51 GMT

Is Eventcode a field or a string? You are treating it as a string. If it is a field and not a string, your search won't work
Make sure you are getting the _raw data you expect after your search criteria. Your rex for is suspect as it doesn't match the case used in the search.

To Ayn's point, what data are you working with and what are you trying to do?