Check Point: Linking events together to produce a results set

[nbonner]

I am looking to build a dashboard where a user can submit a session number & retrieve the entire history of a session with one catch: the session id isn’t on the last event but there is a UID that links one of the events to the last event. This pertains to Check Point SmartWorkflow if that helps anyone.

The relevant events would look something like this:

SessionID1 user1 changeType1 UID1
SessionID1 user1 changeType2 UID2
SessionID1 user1 changeType3 UID3
SessionID1 user1 changeType4 UID4
NoSessionID user2 changeType5 UID2

It would be nice to just use the session id but I also need the extra event that includes UID2 with no session id. This is probably a simple query but I haven’t quite figured it out.

Thanks!

[sundareshr · Accepted solution]

Try this (assuming fields have been extracted)

index=* sessionid=$sid$ OR [search index=* changetype2 | return uid]

[nbonner]

This ended up being close to the correct query. Thank you for the assistance.

[sundareshr]

How do you know which UID is tied to this session? for example Is the always the same as the UID for the second event?

[nbonner]

Ah yes I left that out.
ChangeType2 is always correlated with UID2