Splunk Search

Can you help me fix my Splunk search?

olawalePS
Path Finder

I am trying to create an alert that triggers if a user successfully logs in without first having been successfully authenticated via MFA. The query is below:

 

index="okta" sourcetype="OktaIM2:log" outcome.result=SUCCESS description="User login to Okta" OR description="Authentication of user via MFA"
| transaction maxspan=1h actor.alternateId, src_ip
| where (mvcount(description) == 1)
| where (mvindex(description, "User login to Okta") == 0)

 

 

I keep getting the error 

 

Error in 'where' command: The arguments to the 'mvindex' function are invalid.

 

 

Please help me correct my search and explain what I am doing wrong.

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The second argument to mvindex must be an integer.  I think perhaps you want something like this:

| where (mvindex(description, mvfind(description,"User login to Okta")) == 0)

or, even better

| where (isnotnull(mvfind(description, "User login to Okta")))
---
If this reply helps you, Karma would be appreciated.

View solution in original post

inventsekar
SplunkTrust
SplunkTrust
  • Hi, I am not sure of how the two where commands are working in your SPL.

but, the mvindex second argument must be a "number". 

 

mvindex(<mv>, <start>, <end>)

This function returns a subset of the multivalue field using the start and end index values.

Usage.....The <mv> argument must be a multivalue field. The <start> and <end> indexes must be numbers.

The <mv> and <start> arguments are required. The <end> argument is optional.

 

https://docs.splunk.com/Documentation/SCS/current/SearchReference/MultivalueEvalFunctions

 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The second argument to mvindex must be an integer.  I think perhaps you want something like this:

| where (mvindex(description, mvfind(description,"User login to Okta")) == 0)

or, even better

| where (isnotnull(mvfind(description, "User login to Okta")))
---
If this reply helps you, Karma would be appreciated.

olawalePS
Path Finder

The first one still threw an error but the second worked fine, thanks

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...