Splunk Search

Are hidden characters breaking my joins?

ttovarzoll
Path Finder

I am trying to build an Alert for login failures in AWS CloudTrail. In general I have it working -- but my joins are missing some of the desired events.  Specifically, I am building an 'index' value consisting of the username+IP, e.g.

| eval user_IP = username + src_ip

but I now see that some seemingly-identical values are being evaluated as separate. For instance, when you click on the Selected Values view (left-side in the results) there will be 2 separate entries which -- at least on-screen -- appear to be identical.

WHAT THE POPUP SHOWS

user_IP
2 Values, 100% of events

Values                Count
firstuser172.31.1.1   2
firstuser172.31.1.1   1

I suspect there is a hidden character in the second Value. Or, maybe a trailing space (though there is none when I try adding each to the search).

----

How can I modify my 'eval' to generate values without hidden characters?

(I already tried adding a lower() function but without success)

Labels (1)
Tags (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

One way to check is to bracket the string.

| eval user_IP = ">" . username . src_ip . "<"

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

If I remember correctly there were some issues with leading/trailing spaces when using the interesting fields @yuanliu 's idea is a way to verify it.

yuanliu
SplunkTrust
SplunkTrust

One way to check is to bracket the string.

| eval user_IP = ">" . username . src_ip . "<"

ttovarzoll
Path Finder

Aha! yes, that's a good trick. At first I didn't understand how that would fix the problem but then I realized that it was the perfect troubleshooting step -- and it demonstrated that there was a trailing space.

So, I have now modified my eval statement and confirmed that I am now receiving the missing events

| eval user_IP = username . trim(src_ip)

 I also had to add matching trim() statements to several other references to 'username' throughout the SPL query.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...