Splunk Search

Combine multiple events into a new field

wgawhh5hbnht
Path Finder

I'm attempting to find out when Windows event log service has been stopped/logs cleared but only when a shutdown command hasn't been issued. I'm assuming the best way to do this is to combine all the stopped EventCodes into 1 field, all the shutdown/restart EventCodes into another field, then search based on first & last of those 2 new fields, and remove any null Shutdown events. My questions are:

  1. Is this the best way to approach this problem? If not, what is?
  2. How do you go about combining the following together:
  3. clearedLogs = (EventCode=1102 OR EventCode=1100 OR EventCode=104)
  4. Shutdown = (EventCode=1074 OR EventCode=6006 OR EventCode=6008 OR EventCode=6005 OR EventCode=6009 OR EventCode=1076)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

index=<You should always specify and index> AND sourcetype=<And sourcetype too>
(EventCode="1102" OR EventCode="1100" OR EventCode="104") OR
(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")
| reverse
| streamstats count(eval(EventCode="1102" OR EventCode="1100" OR EventCode="104")) AS sessionID BY host
| stats list(_raw) AS Events values(EventCode) AS EventCodes count(eval(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")) AS shutdowns
BY sessionID host
| search  shutdowns=0

View solution in original post

woodcock
Esteemed Legend

Try this:

index=<You should always specify and index> AND sourcetype=<And sourcetype too>
(EventCode="1102" OR EventCode="1100" OR EventCode="104") OR
(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")
| reverse
| streamstats count(eval(EventCode="1102" OR EventCode="1100" OR EventCode="104")) AS sessionID BY host
| stats list(_raw) AS Events values(EventCode) AS EventCodes count(eval(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")) AS shutdowns
BY sessionID host
| search  shutdowns=0

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi wgawhh5hbnht,
you could try something like this:

index=wineventlog (EventCode=1102 OR EventCode=1100 OR EventCode=104 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008 OR EventCode=6005 OR EventCode=6009 OR EventCode=1076)
| eval type_of_action=if(EventCode="1102" OR EventCode="1100" OR EventCode="104", "clearedLogs", "Shutdown")
| stats earliest(_time) AS earliest latest(_time) AS latest values(type_of_action) AS type_of_action BY host 

in this way for every host you have the first and the last event for each host.
Bye.
Giuseppe

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.