Splunk Search

Combine multiple events into a new field

wgawhh5hbnht
Communicator

I'm attempting to find out when Windows event log service has been stopped/logs cleared but only when a shutdown command hasn't been issued. I'm assuming the best way to do this is to combine all the stopped EventCodes into 1 field, all the shutdown/restart EventCodes into another field, then search based on first & last of those 2 new fields, and remove any null Shutdown events. My questions are:

  1. Is this the best way to approach this problem? If not, what is?
  2. How do you go about combining the following together:
  3. clearedLogs = (EventCode=1102 OR EventCode=1100 OR EventCode=104)
  4. Shutdown = (EventCode=1074 OR EventCode=6006 OR EventCode=6008 OR EventCode=6005 OR EventCode=6009 OR EventCode=1076)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

index=<You should always specify and index> AND sourcetype=<And sourcetype too>
(EventCode="1102" OR EventCode="1100" OR EventCode="104") OR
(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")
| reverse
| streamstats count(eval(EventCode="1102" OR EventCode="1100" OR EventCode="104")) AS sessionID BY host
| stats list(_raw) AS Events values(EventCode) AS EventCodes count(eval(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")) AS shutdowns
BY sessionID host
| search  shutdowns=0

View solution in original post

woodcock
Esteemed Legend

Try this:

index=<You should always specify and index> AND sourcetype=<And sourcetype too>
(EventCode="1102" OR EventCode="1100" OR EventCode="104") OR
(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")
| reverse
| streamstats count(eval(EventCode="1102" OR EventCode="1100" OR EventCode="104")) AS sessionID BY host
| stats list(_raw) AS Events values(EventCode) AS EventCodes count(eval(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")) AS shutdowns
BY sessionID host
| search  shutdowns=0

gcusello
SplunkTrust
SplunkTrust

Hi wgawhh5hbnht,
you could try something like this:

index=wineventlog (EventCode=1102 OR EventCode=1100 OR EventCode=104 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008 OR EventCode=6005 OR EventCode=6009 OR EventCode=1076)
| eval type_of_action=if(EventCode="1102" OR EventCode="1100" OR EventCode="104", "clearedLogs", "Shutdown")
| stats earliest(_time) AS earliest latest(_time) AS latest values(type_of_action) AS type_of_action BY host 

in this way for every host you have the first and the last event for each host.
Bye.
Giuseppe

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...