Unable to display Event count when including only certain interesting fields criteria

[LS1]

  

Hello, maybe I don't have the vocabulary to find the answer when Googling.  I only submit this question after many attempts to find the answer on my own. 

I am trying to figure out why neither "started" nor "blocked" will show events when I add them to my search criteria, as shown in the images. The "success" action returns events found in  the same "Interesting Fields" category ("action"). When using the search: index=security action="*" the event listings include what's been "blocked" (and what's been "started"). I can then add a search on "failed" password and the correct number of events display.  All of the "report" options: Top value, Events with this field, etc all display the proper count for "Blocked".

I have tried other "Interesting fields" with greater values wondering if there was some kind of limit set somewhere, but they work.   

I'm sure it's simple but I cannot figure it out.  Please advise.

Thanks

LS

[LS1]

Hello folks,  thanks for all of the feedback!!  When I tried the offered suggestion, I got results that included Started and Success, but I still didn't get results from Blocked. 

index=security action IN ("Blocked", "Started", "Success") 

Splunk for Unix and Linux add-on will not load. I get an error stating the system it is trying to load does not run on either of the OS's. 

It makes sense that I don't have the proper Add-on loaded but I am unable to figure which it is. I appreciate all of your help, folks. I am trying to learn this tool and am in training. This is not a job related query. I do not want to waste your time. Thanks again!

[PickleRick]

How did you come up with the second search? Is that the same as the first one just with one additional condition? What does your data look like?

[LS1]

Hello, pardon my lack of proper vocab.  For the second search, I opened the "action" field in "Interesting Fields" and then clicked on the desired query (blocked, started, and success). The only one that produces found events is success.  Below please find a sample of the practice data used:

Thu Mar 31 2021 00:15:02 www1 sshd[4747]: Failed password for invalid user jabber from 118.142.68.222 port 3187 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[4111]: Failed password for invalid user db2 from 118.142.68.222 port 4150 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[5359]: Failed password for invalid user pmuser from 118.142.68.222 port 3356 ssh2
Thu Mar 31 2021 00:15:02 www1 su: pam_unix(su:session): session opened for user root by djohnson(uid=0)
Thu Mar 31 2021 00:15:02 www1 sshd[2660]: Failed password for invalid user irc from 118.142.68.222 port 4343 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[1705]: Failed password for happy from 118.142.68.222 port 4174 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[1292]: Failed password for nobody from 118.142.68.222 port 1654 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[1560]: Failed password for invalid user local from 118.142.68.222 port 4616 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[59414]: Accepted password for myuan from 10.1.10.172 port 1569 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[1876]: Failed password for invalid user db2 from 118.142.68.222 port 1151 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[3310]: Failed password for apache from 118.142.68.222 port 4343 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[2149]: Failed password for nobody from 118.142.68.222 port 1527 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[2766]: Failed password for invalid user guest from 118.142.68.222 port 2581 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[3118]: pam_unix(sshd:session): session opened for user djohnson by (uid=0)

[PickleRick]

As @ITWhisperer pointed out, your events don't seem to contain the action field directly nor its values. They must be then populated by means of knowledge objects, most probably from TA_nix. Intuitively it smells like some kind of permission issues but I'm not 100% sure about that.

[gcusello]

Hi @LS1 ,

did you tried to click on the value in interesting fields to add to the search?

on this way, you can see the exact syntax to use that you can add to your main search.

Ciao.

Giuseppe

[LS1]

Hello GCusello, yes I clicked on the word(s) "Blocked" and "Started" in the "Action" field window.  When I use the query index=security action="*" all three actions: Blocked, Started and  Success appear as shown in my original question. If I click on "Success" all of my events are returned, when I click on the other two, my results are "No results found". 

I went down the list of Interesting Fields and tried all of the fields labeled with an  (not sure how to type that one) instead of an octothorp (#) and every one of them worked properly.  When I say I tried, I mean I opened the Interesting Fields and clicked on the desired selection, which alters the search criteria, the same way I have done with Blocked and Started. 

I do not know how the categories get created in the Interesting Fields but it appears there is something wrong with Blocked and Started.

[gcusello]

Hi @LS1 ,

you should try something like this:

 index=security action IN ("Blocked", "Started", "Success")

I hinted to click on the value to be sure that the syntax is correct.

Ciao.

Giuseppe

[LS1]

Hello, pardon my lack of proper vocab.  Yes, for the second search I opened the "action" field in "Interesting Fields" and then clicked on the desired query (blocked, started, and success). The only one that produces found events is success.  Below please find a sample of the practice data used:

Thu Mar 31 2021 00:15:02 www1 sshd[4747]: Failed password for invalid user jabber from 118.142.68.222 port 3187 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[4111]: Failed password for invalid user db2 from 118.142.68.222 port 4150 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[5359]: Failed password for invalid user pmuser from 118.142.68.222 port 3356 ssh2

[LS1]

Hello, pardon my lack of proper vocab.  For the second search, I opened the "action" field in "Interesting Fields" and then clicked on the desired query (blocked, started, and success). The only one that produces found events is success.  Below please find a sample of the practice data used:

Thu Mar 31 2021 00:15:02 www1 sshd[4747]: Failed password for invalid user jabber from 118.142.68.222 port 3187 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[4111]: Failed password for invalid user db2 from 118.142.68.222 port 4150 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[5359]: Failed password for invalid user pmuser from 118.142.68.222 port 3356 ssh2
Thu Mar 31 2021 00:15:02 www1 su: pam_unix(su:session): session opened for user root by djohnson(uid=0)
Thu Mar 31 2021 00:15:02 www1 sshd[2660]: Failed password for invalid user irc from 118.142.68.222 port 4343 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[1705]: Failed password for happy from 118.142.68.222 port 4174 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[1292]: Failed password for nobody from 118.142.68.222 port 1654 ssh2

[ITWhisperer]

It is a bit difficult to figure out what might be going on without some sample data. Please post some anonymised raw (unformatted) events in a code block using the </> format button above so we can see what you are dealing with.

[LS1]

Hello, pardon my lack of proper vocab.  I hope I responded properly to your request for additional info. These are just the first two events from the data (.txt) file.  

Thu Mar 31 2021 00:15:02 www1 sshd[4747]: Failed password for invalid user jabber from 118.142.68.222 port 3187 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[4111]: Failed password for invalid user db2 from 118.142.68.222 port 4150 ssh2
Thu Mar 31 2021 00:15:02 www1 sshd[5359]: Failed password for invalid user pmuser from 118.142.68.222 port 3356 ssh2
Thu Mar 31 2021 00:15:02 www1 su: pam_unix(su:session): session opened for user root by djohnson(uid=0)
Thu Mar 31 2021 00:15:02 www1 sshd[2660]: Failed password for invalid user irc from 118.142.68.222 port 4343 ssh2

[ITWhisperer]

How is the action field populated as these events don't have "started", "blocked" nor "success"?