How to make a query that will trigger when second query finds nothing?

[intrach]

Hi,

I am a beginner in splunk and would like to ask if anyone can help me with creating a search or alert that would trigger if a certain condition 2 is not seen.

Example. 

first condition is if src_ip has event 1234 and event 2345 that is allowed in WAF,

then  second condition is to check if same src_ip does not have event 3456 in IPS.

[intrach]

Hi Thanks,

It just got a bit more complicated, so now this is the use case we want to  explore
a. Successful and blocked request from the same IP address in WAF
b. If the same IP in the WAF is blocked at the IPS, don’t alert


Any idea on this? Thank you so much

[gcusello · Accepted solution]

Hi @intrach,

let me understand: what are the conditions for successful and blocked in waf?

it should be action=allowed and action=denied.

Then you don't want to trigger if the src_ip is in ips, is it correct?

If this is the condition, you could run something like this:

index=waf (src_ip="1234" OR src_ip="2345") (action=allowed OR action=denied) NOT [ search index=ips src="3456" | dedup src_ip | fields src_ip ]
| stats dc(action) AS dc_action BY src_ip
| where dc_action=2

If the above condition aren't the ones you need, please, describe your conditions to test.

Ciao.

Giuseppe

[intrach]

Thank you so much!

[gcusello]

Hi @intrach,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @intrach,

if in the second search you have less than 50,000 results, you could use something like this:

index=waf (src_ip="1234" OR src_ip="2345") NOT [ search index=ips src="3456" | dedup src_ip | fields src_ip ]
| ...

if instead, you have more than 50,000 results in the second search, you have to use a different solution:

(index=waf (src_ip="1234" OR src_ip="2345")) OR (index=ips src="3456")
| stats dc(index9 AS dc_index values(index) AS index BY src_ip
| where dc_index=1 AND index=waf
| ...

if you need more fields using the second search, you can add them as values in the stats command.

Ciao.

Giuseppe