Splunk Search

Check Point: Linking events together to produce a results set

nbonner
Explorer

I am looking to build a dashboard where a user can submit a session number & retrieve the entire history of a session with one catch: the session id isn’t on the last event but there is a UID that links one of the events to the last event. This pertains to Check Point SmartWorkflow if that helps anyone.

The relevant events would look something like this:

SessionID1 user1 changeType1 UID1
SessionID1 user1 changeType2 UID2
SessionID1 user1 changeType3 UID3
SessionID1 user1 changeType4 UID4
NoSessionID user2 changeType5 UID2

It would be nice to just use the session id but I also need the extra event that includes UID2 with no session id. This is probably a simple query but I haven’t quite figured it out.

Thanks!

Tags (1)
0 Karma
1 Solution

sundareshr
Legend

Try this (assuming fields have been extracted)

index=* sessionid=$sid$ OR [search index=* changetype2 | return uid]

View solution in original post

0 Karma

sundareshr
Legend

Try this (assuming fields have been extracted)

index=* sessionid=$sid$ OR [search index=* changetype2 | return uid]
0 Karma

nbonner
Explorer

This ended up being close to the correct query. Thank you for the assistance.

0 Karma

sundareshr
Legend

How do you know which UID is tied to this session? for example Is the always the same as the UID for the second event?

0 Karma

nbonner
Explorer

Ah yes I left that out.
ChangeType2 is always correlated with UID2

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>