Splunk Enterprise Security

How to get the data in groups for a particular set of data?

gndivya
Explorer

Hi,

I have 2 sets of data as below.

Set1
User1 dest1 Time1 EventCode-4722
User1 dest1 Time2 EventCode-4726
User1 dest1 Time3 EventCode-4722
User1 dest1 Time4 EventCode-4726
User1 dest1 Time5 EventCode-4722

Set2
User2 dest2 Time1 EventCode-4726
User2 dest2 Time2 EventCode-4722
User2 dest2 Time3 EventCode-4726

I need to get all the complete set (includes other fields) of data which starts with Event code 4722 and ends with 4726. How can I achieve this?

I want data as
set 1
User1 dest1 Time1 EventCode-4722
User1 dest1 Time2 EventCode-4726

set 2
User1 dest1 Time3 EventCode-4722
User1 dest1 Time4 EventCode-4726

set3
User2 dest2 Time2 EventCode-4722
User2 dest2 Time3 EventCode-4726

Please help. thanks in advance.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gndivya

Can you please try this?

YOUR_SEARCH | transaction endswith=EventCode="EventCode-4722" 
| where linecount=2 
| eval tmp=mvzip(Time,EventCode) 
| mvexpand tmp 
| eval Time=mvindex(split(tmp,","),0),EventCode=mvindex(split(tmp,","),1) 
| table User Dest Time EventCode

Sample Search:

| makeresults count=5 
| eval a=1 
| accum a 
| eval User="User1", Dest="dest1",Time="Time".a , c=a%2, EventCode="EventCode-".if(c==1,4722,4726) 
| table _time User Dest Time EventCode 
| rename comment as "Upto this is for data generation only" 
| transaction endswith=EventCode="EventCode-4722" 
| where linecount=2 
| eval tmp=mvzip(Time,EventCode) 
| mvexpand tmp 
| eval Time=mvindex(split(tmp,","),0),EventCode=mvindex(split(tmp,","),1) 
| table User Dest Time EventCode



| makeresults count=3 
| eval a=1 
| accum a 
| eval User="User2", Dest="dest2",Time="Time".a , c=a%2, EventCode="EventCode-".if(c==1,4726,4722) 
| table _time User Dest Time EventCode
| rename comment as "Upto this is for data generation only"
| transaction endswith=EventCode="EventCode-4722" 
| where linecount=2 
| eval tmp=mvzip(Time,EventCode) 
| mvexpand tmp 
| eval Time=mvindex(split(tmp,","),0),EventCode=mvindex(split(tmp,","),1) 
| table User Dest Time EventCode
0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...