https://community.splunk.com/t5/Splunk-Search/How-do-I-string-certain-searches-together-to-get-a-list-of-user/m-p/334800#M99512 <P>I have connection logs for a database. I need to identify users making certain queries. I'd like to:</P> <OL> <LI>Search for a string identifying the query</LI> <LI>Check that whole transaction for the original "open connection" event to get the IP address</LI> <LI>The IP address is a load balancer, so I have to check that IP/port in the load balancer logs to get the actual user IP address</LI> </OL> <P>How do I string these searches together to get a list of user IP addresses doing a particular query? I suspect the "transaction" command is key here, but I haven't found a clue in the examples.</P> Wed, 07 Mar 2018 19:18:53 GMT dangerusty 2018-03-07T19:18:53Z https://community.splunk.com/t5/Splunk-Search/How-do-I-string-certain-searches-together-to-get-a-list-of-user/m-p/334800#M99512 <P>I have connection logs for a database. I need to identify users making certain queries. I'd like to:</P> <OL> <LI>Search for a string identifying the query</LI> <LI>Check that whole transaction for the original "open connection" event to get the IP address</LI> <LI>The IP address is a load balancer, so I have to check that IP/port in the load balancer logs to get the actual user IP address</LI> </OL> <P>How do I string these searches together to get a list of user IP addresses doing a particular query? I suspect the "transaction" command is key here, but I haven't found a clue in the examples.</P> Wed, 07 Mar 2018 19:18:53 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-string-certain-searches-together-to-get-a-list-of-user/m-p/334800#M99512 dangerusty 2018-03-07T19:18:53Z https://community.splunk.com/t5/Splunk-Search/How-do-I-string-certain-searches-together-to-get-a-list-of-user/m-p/334801#M99513 <P>(1) <CODE>Transaction</CODE> is very resource intensive and there is almost always a better way. If you post the non-confidential portions of the searches here, then we can be of more help.<BR /><BR /> (2) Often, this kind of thing will be much simpler if it is in a dashboard. That way, the time of the event can be detected from the first search and used to qualify the second and/or third searches. Otherwise, you end up coding something that has to search a massive amount of data for very little value.</P> Wed, 07 Mar 2018 19:57:58 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-string-certain-searches-together-to-get-a-list-of-user/m-p/334801#M99513 DalJeanis 2018-03-07T19:57:58Z https://community.splunk.com/t5/Splunk-Search/How-do-I-string-certain-searches-together-to-get-a-list-of-user/m-p/334802#M99514 <BLOCKQUOTE> <P>Sourcetype="ldap" "filter=\"(id=1)\""</P> </BLOCKQUOTE> <PRE><CODE>[07/Mar/2018:14:01:11 -0600] - OPERATION - INFO - conn=12345 op=123 msgid=456 SEARCH base="example.com" scope=2 controls="" filter="(id=1)" attrs="*" </CODE></PRE> <BLOCKQUOTE> <P>Sourcetype="ldap" conn=12345 client</P> </BLOCKQUOTE> <PRE><CODE>[07/Mar/2018:14:00:37 -0600] - CONNECT - INFO - conn=12345 client=10.0.0.2:56789 </CODE></PRE> <BLOCKQUOTE> <P>Sourcetype="loadbalancer" "10.0.0.2|56789"</P> </BLOCKQUOTE> <PRE><CODE>Client_Acpt | Wed Mar 07 2018 14:00:37 | 10.0.0.5|56789| VIP | 10.0.0.4|636 | SNAT_IP | 10.0.0.2|56789 | Node | 10.0.0.3|636 </CODE></PRE> <P>I want a list of user IP addresses (such as 10.0.0.5 in this case) that searched with filter="(id=1)".</P> Wed, 07 Mar 2018 21:00:41 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-string-certain-searches-together-to-get-a-list-of-user/m-p/334802#M99514 dangerusty 2018-03-07T21:00:41Z