topic rename EventCodes in Splunk Search

rename EventCodes

smudge797 — Tue, 15 Mar 2016 08:31:45 GMT

Is there a way to rename EventCodes xxxx field to "description" in timechart? Here is a sample search:

Account_Name=* (EventCode=4800 OR EventCode=4801 OR EventCode=4768) index=blah sourcetype="WinEventLog:Security" source="WinEventLog:Security" | timechart count by EventCode

Thanks!

Re: rename EventCodes

chimell — Tue, 15 Mar 2016 08:36:23 GMT

Hi
I rectified use case statement and retry

 Account_Name=* (EventCode=4800 OR EventCode=4801 OR EventCode=4768) index=blah sourcetype="WinEventLog:Security" source="WinEventLog:Security"|eval description=case(EventCode=="4768","A Kerberos authentication ticket (TGT) was requested and User Logged in", EventCode=="4800" , "The workstation was locked" , EventCode=="4801" , "The workstation was unlocked") | timechart count by description

Re: rename EventCodes

smudge797 — Tue, 15 Mar 2016 08:46:51 GMT

Thanks but i need the description to be something like:
4768 A Kerberos authentication ticket (TGT) was requested
4800 The workstation was locked
4801 The workstation was unlocked
4768 User Logged in

Rather than just listing the event codes.

Re: rename EventCodes

fdi01 — Tue, 15 Mar 2016 09:48:48 GMT

you can use replace command to do it .

try like this:

... | replace 4800 with "The workstation was locked" in EventCode| replace 4801 with "The workstation was unlocked" in EventCode|.....

Re: rename EventCodes

chimell — Tue, 15 Mar 2016 10:11:31 GMT

just retry my new search code above

Re: rename EventCodes

smudge797 — Tue, 15 Mar 2016 12:11:55 GMT

Nice! Thanks

Re: rename EventCodes

chimell — Tue, 15 Mar 2016 12:15:23 GMT

where are the query that you propose ?

Re: rename EventCodes

fdi01 — Wed, 16 Mar 2016 08:39:39 GMT

i ok with Mm chimell where is your answer Mm smudge797
post your answer because it can help somebody
thanks.

Re: rename EventCodes

smudge797 — Wed, 16 Mar 2016 08:50:16 GMT

This worked from Chimell. Thanks

Account_Name=* (EventCode=4800 OR EventCode=4801 OR EventCode=4768) index=blah sourcetype="WinEventLog:Security" source="WinEventLog:Security"|eval description=case(EventCode=="4768","A Kerberos authentication ticket (TGT) was requested and User Logged in", EventCode=="4800" , "The workstation was locked" , EventCode=="4801" , "The workstation was unlocked") | timechart count by description

Re: rename EventCodes

fdi01 — Wed, 16 Mar 2016 09:01:31 GMT

go accept and upvote answer of Mm chimell if you agree Mm smudge797
thanks.

Re: rename EventCodes

alemarzu — Wed, 16 Mar 2016 13:29:25 GMT

Hi smudge,

Did you try CSV lookups ? Check this out

http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Addfieldsfromexternaldatasources#CSV_lookup_example

Hope it helps!

Re: rename EventCodes

DMohn — Wed, 16 Mar 2016 13:49:20 GMT

You should use a csv-Lookup here...

Just follow these steps:

Create a csv-file containing the EventCodes and the Description you could use this site as a reference for the csv: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx
Upload the csv-file to Splunk via Settings -> Lookups -> Lookup Table files -> New
optional: Create a lookup-Definition and a automatic lookup for your sourcetype (reference here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources)
Use the lookup to add the additional knowledge data

Assuming your csv has the name winevents.csv and has this structure:

 EventCode,Description
 513,Windows is shutting down
 514,An authentication package has been loaded by the Local Security Authority

this would be your search:

 Account_Name=* (EventCode=4800 OR EventCode=4801 OR EventCode=4768) index=blah sourcetype="WinEventLog:Security" source="WinEventLog:Security" | lookup winevents.csv EventCode OUTPUT Description | timechart count by Description

Re: rename EventCodes

chimell — Tue, 22 Mar 2016 09:30:04 GMT

hi smudge797
you say that my answer is good . Now vote it .

Re: rename EventCodes

rashid47010 — Tue, 21 Jun 2016 12:44:21 GMT

hi I am following the guideline but i am facing the error: Could not find all of the specified lookup fields in the lookup table" Please advise