Archive

How can I add the "act*" and "target*" fields to this table with "Host" being the primary field?

Explorer

Hello everyone,

This search is designed to alert on potential password spraying attempts on servers in my environment. I have this search working when I leave out "| appendpipe [table act* target*]", but I am trying to figure out how to add those fields to the results while keeping my created "Server" field intact. Any ideas are greatly appreciated.

index=wineventlog sourcetype=WinEventLog:Security EventCode=4625 
| eval event=_raw
| rex mode=sed field=event "s/[\n\r]//g"
| rex field=event "Subject:.*Security ID:\t*(?.*?)\tAccount Name:(?.*?)\t*Account Domain:\t*(?.*?)Logon ID:\t*(?.*?)Logon Type"
| rex field=event "Account For Which Logon Failed:\tSecurity ID:\t*(?.*?)\tAccount Name:(?.*?)\t*Account Domain:\t*(?.*?)Failure Information" 
| bin _time span=1m 
| stats dc(user) as EvtCounts by src 
| rename src as server
| where EvtCounts >50
| eval Server = server." (".EvtCounts.")"
| table Server
| appendpipe [table act* target*]
Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

The only fields available at the end of your query are 'server' and 'EvtCounts. That's because thestatscommand filters out all fields except those explicitly mentioned. You should be able to avoid that by usingstreamstats`. Like this:

| streamstats dc(user) as EvtCounts by src 
| rename src as server
| where EvtCounts >50
| eval Server = server." (".EvtCounts.")"
| table Server act target*
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

The only fields available at the end of your query are 'server' and 'EvtCounts. That's because thestatscommand filters out all fields except those explicitly mentioned. You should be able to avoid that by usingstreamstats`. Like this:

| streamstats dc(user) as EvtCounts by src 
| rename src as server
| where EvtCounts >50
| eval Server = server." (".EvtCounts.")"
| table Server act target*
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Explorer

Thank you very much Rich! Using streamstats did the trick.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!