topic Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour? in Splunk Search

How to search for hosts with an issue where a type of event was not followed by another type within an hour?

shellnight — Mon, 24 Nov 2014 11:17:01 GMT

Need to find hosts where an event of a type was not followed by event of another type within an hour

I need to find hosts where virus infection was detected and it failed to perform any action, where "None" is not followed up by of the other events " Blocked OR removed OR quarantined" in 1 hour

Fields available are

ComputerName=
VirusName= 
Action Taken=

Sample log

10/11/2014 20:01 : ComputerName=test1 VirusName=conficker  ActionTaken=None 
10/11/2014 20:02 "ComputerName=test1 VirusName=conficker  ActionTaken=blocked 
10/11/2014 22:01 : ComputerName=test20 VirusName=conficker  ActionTaken=None
10/11/2014 20:01 : ComputerName=test30 VirusName=conficker  ActionTaken=None 
10/11/2014 20:02 "ComputerName=test30 VirusName=conficker  ActionTaken=removed

As you can seen above, no action was taken by antivirus on Computer test20. I need to write a search query to create a report or dashboard to find any such machine.

Any pointers in the right direction would be appreciated

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

felipetesta — Mon, 24 Nov 2014 11:46:17 GMT

Would it work?

<your search here> | transaction maxspan=70m ComputerName startswith="ActionTaken=None" keepevicted=f | search NOT Blocked NOT removed NOT quarantined | table ComputerName, VirusName

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

hagjos43 — Mon, 24 Nov 2014 12:37:37 GMT

What Antivirus software are you using?

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

shellnight — Mon, 24 Nov 2014 13:34:57 GMT

The search ran for logs of a 1 month period with no errors but failed to retrieve any results

One machine had 3 occurrences of action taken= none and wasnt followed by any removal actions

10/11/2014 20:01 : ComputerName=test1 VirusName=conficker ActionTaken=None 
10/11/2014 20:02 "ComputerName=test1 VirusName=conficker ActionTaken=None 
10/11/2014 20:03 : ComputerName=test1 VirusName=conficker ActionTaken=None

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

shellnight — Mon, 24 Nov 2014 15:36:11 GMT

please can someone help

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

somesoni2 — Mon, 24 Nov 2014 17:36:35 GMT

Give this a try

your base search | transaction maxspan=60m startswith="ActionTaken=None" keeporphans=t  | where mvcount(ActionTaken) =1 AND mvindex(ActionTaken,0)="None"

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

shellnight — Mon, 24 Nov 2014 19:38:52 GMT

thank you very much 🙂

It works fine

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

shellnight — Fri, 28 Nov 2014 10:11:28 GMT

Hello somesoni2 can you update the query to exclude the events where actiontaken is either partly removed or Unknown so that they show up in search

your base search | transaction maxspan=60m startswith="ActionTaken=None" keeporphans=t | where mvcount(ActionTaken) =1 AND mvindex(ActionTaken,0)="None"

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

shellnight — Fri, 28 Nov 2014 15:43:10 GMT

Hello please can you provide update

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

somesoni2 — Fri, 28 Nov 2014 20:47:41 GMT

I hope you're saying you want to INCLUDE events where final "Action Taken" is "Partly Remove" OR "Unkonwn", so try this one.

your base search | transaction maxspan=60m startswith="ActionTaken=None" keeporphans=t  | where isnull(mvfind(ActionTaken,"removed")) OR isnull(mvfind(ActionTaken,"blocked"))

Basically add all the ActionTaken your want to exclude in the where clause

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

ppablo — Wed, 03 Dec 2014 01:37:45 GMT

Hi @shellnight

@somesoni2 responded to the thread above with an update. Can you respond to that as a comment to confirm whether or not that updated search solves your requirement?

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

shellnight — Wed, 10 Dec 2014 13:33:22 GMT

Error in 'where' command: The arguments to the 'isnull' function are invalid.

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

shellnight — Thu, 11 Dec 2014 12:54:46 GMT

Hello there

can you please check if there is something wrong in the syntax

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

somesoni2 — Wed, 17 Dec 2014 18:17:03 GMT

I updated the query. Please check back.

Re: How to search for hosts with an issue where a type of event was not followed by another type within an hour?

ppablo — Tue, 30 Dec 2014 07:42:00 GMT

Hi @shellnight

@somesoni2 updated the query. can you confirm whether or not this worked for you?