Splunk Enterprise

How to split up a search in a data model

New Member

I'm trying to take a search and put it into a data model. I really don't understand the documentation online about using root events and transaction events and the other stuff. I've done simple constraints with just one root event and that has been fine. I'm pretty sure I need to start with a root event but, since you can't put pipes in the constraints, I'm having a difficult time getting this search into the model. Here is the search:

(EventCode=4624 OR EventCode=4625) AND LogonType=3 AuthenticationPackage=NTLM NOT AccountName="ANONYMOUS LOGON" AND AccountDomain="CHI" [ search EventCode=8001 NOT Domainnameofuser="CHI" | where _time > relativetime(time,"-5s") | eval WorkstationName = host | fields + Workstation_Name ]

Any help with this is greatly appreciated!

Tags (2)
0 Karma
1 Solution

Champion

You cannot have sub-searches in the constraint of a search in a datamodel.

You can only put in the first part

(EventCode=4624 OR EventCode=4625) AND Logon_Type=3 Authentication_Package=NTLM NOT Account_Name="ANONYMOUS LOGON" AND Account_Domain="CHI"

You should also restrict your search to specific index(es) or sourcetype(s) of some kind.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Didn't get your subsearch-where clause. Won't _time > relative_time(_time,"-5s") always be true?? Or you want to check the _time of base search with subsearch, and that's not possible.

0 Karma

New Member

I'm new to this so I wouldn't be surprised if that doesn't do what I think. I'm more interested in the data model aspect of the question. If it helps, pretend the where clause isn't there.

0 Karma

Champion

You cannot have sub-searches in the constraint of a search in a datamodel.

You can only put in the first part

(EventCode=4624 OR EventCode=4625) AND Logon_Type=3 Authentication_Package=NTLM NOT Account_Name="ANONYMOUS LOGON" AND Account_Domain="CHI"

You should also restrict your search to specific index(es) or sourcetype(s) of some kind.

View solution in original post

0 Karma

New Member

So there is no way for me to add a field from a subsearch into my main search in data models? So I can only use a child to narrow down my results more?

0 Karma

Champion

Not in the search constraint. You can try adding it via a lookup field, but that would require you populating a lookup table with the WorkstationName field via a savedsearch. That may be potentially risky if the WorkstationName field value is very time sensitive relative to your first search. Risky being that your datamodel may not be accurate if the savedsearch to populate the lookup does not run reliably.

0 Karma