Splunk Search

Combine multiple events into a new field

wgawhh5hbnht
Communicator

I'm attempting to find out when Windows event log service has been stopped/logs cleared but only when a shutdown command hasn't been issued. I'm assuming the best way to do this is to combine all the stopped EventCodes into 1 field, all the shutdown/restart EventCodes into another field, then search based on first & last of those 2 new fields, and remove any null Shutdown events. My questions are:

  1. Is this the best way to approach this problem? If not, what is?
  2. How do you go about combining the following together:
  3. clearedLogs = (EventCode=1102 OR EventCode=1100 OR EventCode=104)
  4. Shutdown = (EventCode=1074 OR EventCode=6006 OR EventCode=6008 OR EventCode=6005 OR EventCode=6009 OR EventCode=1076)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

index=<You should always specify and index> AND sourcetype=<And sourcetype too>
(EventCode="1102" OR EventCode="1100" OR EventCode="104") OR
(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")
| reverse
| streamstats count(eval(EventCode="1102" OR EventCode="1100" OR EventCode="104")) AS sessionID BY host
| stats list(_raw) AS Events values(EventCode) AS EventCodes count(eval(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")) AS shutdowns
BY sessionID host
| search  shutdowns=0

View solution in original post

woodcock
Esteemed Legend

Try this:

index=<You should always specify and index> AND sourcetype=<And sourcetype too>
(EventCode="1102" OR EventCode="1100" OR EventCode="104") OR
(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")
| reverse
| streamstats count(eval(EventCode="1102" OR EventCode="1100" OR EventCode="104")) AS sessionID BY host
| stats list(_raw) AS Events values(EventCode) AS EventCodes count(eval(EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076")) AS shutdowns
BY sessionID host
| search  shutdowns=0

gcusello
Esteemed Legend

Hi wgawhh5hbnht,
you could try something like this:

index=wineventlog (EventCode=1102 OR EventCode=1100 OR EventCode=104 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008 OR EventCode=6005 OR EventCode=6009 OR EventCode=1076)
| eval type_of_action=if(EventCode="1102" OR EventCode="1100" OR EventCode="104", "clearedLogs", "Shutdown")
| stats earliest(_time) AS earliest latest(_time) AS latest values(type_of_action) AS type_of_action BY host 

in this way for every host you have the first and the last event for each host.
Bye.
Giuseppe

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...