Can you help me with my splunk search?

[smp8644]

I am trying to write a splunk search to pull what rules a particular user is hitting. This search is helping with that BUT everything is coming through as a urlrulelabel. When I move apprulelabel to the start of the line, everything comes through as an apprulelabel.

When I dive into the events, I see there are other rules showing, but they arent populating in the statistics table.

I would like to have each rule come through as its own. 


index=zscaler sourcetype=zscalernss-web user=*

| eval rule_type=case(isnotnull(urlrulelabel), "urlurlelabel", isnotnull(apprulelabel), "apprulelabel", isnotnull(rulelabel), "rulelabel", true(), "unknown")
| eval rule=coalesce(apprulelabel, urlrulelabel, rulelabel)
| stats count by rule, rule_type
| rename rule as Rule, rule_type as "Type of Rule", count as "Hit Count"
| sort - "Hit Count"

Thank you in advance

[smp8644]

Here is a picture of my results. Hoping to get some help into having the second column populate urlrulelabel, apprulelabel, and rulelabel policies rather than just one.

[ITWhisperer]

As @yuanliu says, you will have a much better chance of getting a useful answer if you follow some simple guidelines.

It is not possible to tell from what you have posted so far what your events actually look like (or a close anonymised representation of them), nor what it is you are trying to determine from your search.

For example, do all the rule fields have either "None" or a rule name in? If so, isnotnull() will always return true, hence all your rules are coming through as "urlurlelabel" (should this be "urlrulelabel"?)

Can there be more than one rule label you are interested in for an event or does apprulelabel always take presidence, even if it is "None", which is what your search is doing, hence the high count for "None"?

Please provide more relevant information (if you would like more help).

[yuanliu]

You'll have a much better chance of getting real help if you really follow this formula for an answerable question:

• Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search that volunteers here do not have to look at.
• Illustrate the desired output from illustrated data.
• Explain the logic between illustrated data and desired output WITHOUT SPL.
• If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious.