All Apps and Add-ons

how can I search for multiple event IDs?

levyma2
Explorer

How would I search for multiple event IDs ?

sourcetype=wineventlog:security EventCode=631 OR Eventcode=632 OR EventCode=633 .......

Is there a way to combine the eventIDs in one EventCode statement?

thanks

Mark

aelliott
Motivator

Or you could have a lookup table with all of your values you want included:
http://answers.splunk.com/answers/26989/does-splunk-have-an-equivalent-to-sqls-in-construct

0 Karma

levyma2
Explorer

Thanks everyone for your input. Now I have a few options to choose from.

Mark

0 Karma

somesoni2
Revered Legend

Another one (little crude, but more generic)

sourcetype=wineventlog:security [* | head 1 | eval EventCode="631,632,633..add all your want separated by comma" |table EventCode| eval EventCode=split(EventCode,",")| mvexpand EventCode]

lukejadamec
Super Champion

Yes, but only for very specific cases.
In the case of your example you could use:

sourcetype=wineventlog:security | regex "EventCode=63[1-3]" |stats count by EventCode ComputerName

0 Karma

Ayn
Legend

Oh come on don't be hurt 🙂

I'm merely stating the problem with the approach. It's still a valid approach but it's important to point out its drawbacks. Between the 3 supplied answers here I believe we've showed what various approaches the user can take. Each of them has its own advantages and disadvantages.

0 Karma

lukejadamec
Super Champion

Splunk Answers is free support, and a mess with half solutions. I say if you have a better anwser - then post it. If you can make an answer better then - adjust it.
It is easy to be a critic.

0 Karma

lukejadamec
Super Champion

sourcetype=wineventlog:security EventCode="63*" | regex "EventCode=63[1-3]" |stats count by EventCode ComputerName

0 Karma

Ayn
Legend

The problem with this is that it would lead to bad performance, because no filtering on EventCode will be done at all in the base search.

0 Karma

Ayn
Legend

No. An OR separated list like the one you've written is the way to go.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!