Want help in creating Splunk Query with specific conditions?

[joomla]

Hi Splunk Members,

Good Day!

I am looking for support to create a query with Windows Security Events Logs. Basically the idea is to search for different Windows Security Event IDs events within a short span by Account Name.

Example: To return events if events id: XXXX occurs at 1 PM EST then within 1 min i.e 1:01 PM; Event ID: YYYY occurs and then event id: ZZZZ also occurs for same Account_Name then my query should results all those events.

Kindly note, condition should met if all three event ids trigger within short span that is 1 min here. If for an example Event ID XXXX occurs but Event IDs YYYY and ZZZZ do not for the same Account Name then results should be zero in the ouput.

Many Thanks.

[ITWhisperer]

``` your search ```
| table _time user event 
``` reverse so we can get row number in ascending order ```
| reverse
| streamstats count as row
``` capture time for each event type ```
| eval XXXXTime=if(event="XXXX",_time,null) 
| eval YYYYTime=if(event="YYYY",_time,null)
| eval ZZZZTime=if(event="ZZZZ",_time,null)
``` capture row for each event type ```
| eval XXXXRow=if(event="XXXX",row,null) 
| eval YYYYRow=if(event="YYYY",row,null) 
| eval ZZZZRow=if(event="ZZZZ",row,null) 
``` track latest time and row for each event type by user ```
| streamstats latest(XXXXTime) as lastXXXX latest(YYYYTime) as lastYYYY latest(ZZZZTime) as lastZZZZ max(XXXXRow) as lastXXXXRow max(YYYYRow) as lastYYYYRow max(ZZZZRow) as lastZZZZRow by user
``` filter for events in XXXX, YYYY, ZZZZ order where ZZZZ is within 60 seconds of last XXXX ```
| where lastXXXXRow < lastYYYYRow AND lastYYYYRow < lastZZZZRow AND lastZZZZ < lastXXXX + 60

[alonsocaio]

Hi @joomla 

I guess you could reach this result by using transaction command. I have tried this way and It seems to work for your use case:

...YOUR SEARCH QUERY...
| transaction Account_Name startswith=eval(EventCode=XXXX) endswith=eval(EventCode=ZZZZ) maxspan=1m
| search EventCode=YYYY