All Apps and Add-ons

how can I search for multiple event IDs?

levyma2
Explorer

How would I search for multiple event IDs ?

sourcetype=wineventlog:security EventCode=631 OR Eventcode=632 OR EventCode=633 .......

Is there a way to combine the eventIDs in one EventCode statement?

thanks

Mark

aelliott
Motivator

Or you could have a lookup table with all of your values you want included:
http://answers.splunk.com/answers/26989/does-splunk-have-an-equivalent-to-sqls-in-construct

0 Karma

levyma2
Explorer

Thanks everyone for your input. Now I have a few options to choose from.

Mark

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Another one (little crude, but more generic)

sourcetype=wineventlog:security [* | head 1 | eval EventCode="631,632,633..add all your want separated by comma" |table EventCode| eval EventCode=split(EventCode,",")| mvexpand EventCode]

lukejadamec
Super Champion

Yes, but only for very specific cases.
In the case of your example you could use:

sourcetype=wineventlog:security | regex "EventCode=63[1-3]" |stats count by EventCode ComputerName

0 Karma

Ayn
Legend

Oh come on don't be hurt 🙂

I'm merely stating the problem with the approach. It's still a valid approach but it's important to point out its drawbacks. Between the 3 supplied answers here I believe we've showed what various approaches the user can take. Each of them has its own advantages and disadvantages.

0 Karma

lukejadamec
Super Champion

Splunk Answers is free support, and a mess with half solutions. I say if you have a better anwser - then post it. If you can make an answer better then - adjust it.
It is easy to be a critic.

0 Karma

lukejadamec
Super Champion

sourcetype=wineventlog:security EventCode="63*" | regex "EventCode=63[1-3]" |stats count by EventCode ComputerName

0 Karma

Ayn
Legend

The problem with this is that it would lead to bad performance, because no filtering on EventCode will be done at all in the base search.

0 Karma

Ayn
Legend

No. An OR separated list like the one you've written is the way to go.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...