Splunk Enterprise

How to split up a search in a data model

pitassi17
New Member

I'm trying to take a search and put it into a data model. I really don't understand the documentation online about using root events and transaction events and the other stuff. I've done simple constraints with just one root event and that has been fine. I'm pretty sure I need to start with a root event but, since you can't put pipes in the constraints, I'm having a difficult time getting this search into the model. Here is the search:

(EventCode=4624 OR EventCode=4625) AND Logon_Type=3 Authentication_Package=NTLM NOT Account_Name="ANONYMOUS LOGON" AND Account_Domain="CHI" [ search EventCode=8001 NOT Domain_name_of_user="CHI" | where _time > relative_time(_time,"-5s") | eval Workstation_Name = host | fields + Workstation_Name ]

Any help with this is greatly appreciated!

Tags (2)
0 Karma
1 Solution

rjthibod
Champion

You cannot have sub-searches in the constraint of a search in a datamodel.

You can only put in the first part

(EventCode=4624 OR EventCode=4625) AND Logon_Type=3 Authentication_Package=NTLM NOT Account_Name="ANONYMOUS LOGON" AND Account_Domain="CHI"

You should also restrict your search to specific index(es) or sourcetype(s) of some kind.

View solution in original post

0 Karma

somesoni2
Revered Legend

Didn't get your subsearch-where clause. Won't _time > relative_time(_time,"-5s") always be true?? Or you want to check the _time of base search with subsearch, and that's not possible.

0 Karma

pitassi17
New Member

I'm new to this so I wouldn't be surprised if that doesn't do what I think. I'm more interested in the data model aspect of the question. If it helps, pretend the where clause isn't there.

0 Karma

rjthibod
Champion

You cannot have sub-searches in the constraint of a search in a datamodel.

You can only put in the first part

(EventCode=4624 OR EventCode=4625) AND Logon_Type=3 Authentication_Package=NTLM NOT Account_Name="ANONYMOUS LOGON" AND Account_Domain="CHI"

You should also restrict your search to specific index(es) or sourcetype(s) of some kind.

0 Karma

pitassi17
New Member

So there is no way for me to add a field from a subsearch into my main search in data models? So I can only use a child to narrow down my results more?

0 Karma

rjthibod
Champion

Not in the search constraint. You can try adding it via a lookup field, but that would require you populating a lookup table with the Workstation_Name field via a savedsearch. That may be potentially risky if the Workstation_Name field value is very time sensitive relative to your first search. Risky being that your datamodel may not be accurate if the savedsearch to populate the lookup does not run reliably.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...