https://community.splunk.com/t5/Splunk-Search/Comparing-Field-Names-and-Values/m-p/151645#M42469 <P>You probably want to look at a certain SID in the events, either the first or the second, and compare that SID across events. Since the Security_ID is present more than once in these events, Splunk creates what is called a multivalued field. The individual values of the field can be accessed with various functions. You can then build so-called <CODE>transactions</CODE> based on this, e.g.</P> <PRE><CODE>your search for events | eval sid2 = mvindex(Security_ID, 1) | transaction sid2 maxpause=5s </CODE></PRE> <P>Read more here;</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Transaction</A></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> <P>/K</P> Fri, 14 Feb 2014 21:18:46 GMT kristian_kolb 2014-02-14T21:18:46Z https://community.splunk.com/t5/Splunk-Search/Comparing-Field-Names-and-Values/m-p/151644#M42468 <P>Hi,</P> <P>I've run into a problem: Splunk ingests Window's security events in such a way that field names may occur more than once and have different values assigned. (<EM>e.g.,</EM> 'Security_ID' can equate to any of the following: alpha-numeric account SID, actual account name, or even account group) I want to compose a search that compares the SIDs from two different events and gives results if a match is found. Something like:</P> <P>Search for two events, A &amp; B, occurring within 5 seconds of each other, where A possesses an alpha-numeric SID that exactly matches an alpha-numeric SID listed in event B. </P> <P>The alpha-numeric value is not known in advance. Any insight on how to do this? Your help is much appreciated!</P> <P>-Dave </P> Fri, 14 Feb 2014 18:25:39 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-Field-Names-and-Values/m-p/151644#M42468 dctopper 2014-02-14T18:25:39Z https://community.splunk.com/t5/Splunk-Search/Comparing-Field-Names-and-Values/m-p/151645#M42469 <P>You probably want to look at a certain SID in the events, either the first or the second, and compare that SID across events. Since the Security_ID is present more than once in these events, Splunk creates what is called a multivalued field. The individual values of the field can be accessed with various functions. You can then build so-called <CODE>transactions</CODE> based on this, e.g.</P> <PRE><CODE>your search for events | eval sid2 = mvindex(Security_ID, 1) | transaction sid2 maxpause=5s </CODE></PRE> <P>Read more here;</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Transaction</A></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> <P>/K</P> Fri, 14 Feb 2014 21:18:46 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-Field-Names-and-Values/m-p/151645#M42469 kristian_kolb 2014-02-14T21:18:46Z https://community.splunk.com/t5/Splunk-Search/Comparing-Field-Names-and-Values/m-p/151646#M42470 <P>Exactly what I needed - thanks again!</P> Tue, 18 Feb 2014 13:41:04 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-Field-Names-and-Values/m-p/151646#M42470 dctopper 2014-02-18T13:41:04Z