Security

How to exclude user name that start with the number "0" on a correlation search on ES?

ajromero
Path Finder

how to exclude user name that start with the number "0" on a correlation search on ES

This is the query:

| from inputlookup:access_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90

and I want to remove all user that start with "0"

ajromero_0-1645731852832.png

Thank you

 

Labels (3)
0 Karma
1 Solution

tofa
Explorer

Hi Araceli,

Possibly a regex exclusion:

| from inputlookup:access_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90
| regex user!="^0|^[0-9a-zA-Z\-]+$|<YOURPATTERNHERE>"

 Or just the opposite: if you, for example, got user with firstname.lastname format in your company:

| from inputlookup:access_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90
| regex user="^[A-Za-z]+\.[A-Za-z]+"​



View solution in original post

0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @ajromero,

You can append  | search user != 0* to the query and exclude users starting with 0. You search query should look something like below:

| from inputlookup:access_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90
| search user != 0*
---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma

ajromero
Path Finder

Hi tshah-splunk

I tried that and it worked, but just realized that there more users with different names like these

ajromero_0-1645806579367.png

How can I exclude that kind of users?

 

Thank you,

Araceli

 

 

 

0 Karma

tofa
Explorer

Hi Araceli,

Possibly a regex exclusion:

| from inputlookup:access_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90
| regex user!="^0|^[0-9a-zA-Z\-]+$|<YOURPATTERNHERE>"

 Or just the opposite: if you, for example, got user with firstname.lastname format in your company:

| from inputlookup:access_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90
| regex user="^[A-Za-z]+\.[A-Za-z]+"​



0 Karma

ajromero
Path Finder

Hi,

that actually worked pretty good for me. 

 

thank you

 

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...