Splunk Search

Combined Linux Searches

gm3ndez
New Member

Hello ,

Im trying to run a audit search for high priority linux servers - should have the following in the search

sudo login, failed login, login/logoff and account change and deletion.

i was able to combine to searches with the "OR" command:

index="ssh_login_index" sourcetype="linux_secure" (process=sshd session opened OR closed) host="linux server"

but still cant combine the rest of the searches to the search above. Thanks in advance!

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @gm3ndez,

I had to do something like this and I solved it with eventtypes and tags:

I created many eventtypes containing each one a single search, e.g.:

[Linux_Audit]
search = index=os sourcetype=linux_secure NOT disconnect

[Linux_Logfail]
search = eventtype=Linux_Audit "failed password"

[Linux_Login]
search = eventtype=Linux_Audit "accepted password"

[Linux_Logout]
search = eventtype=Linux_Audit "session closed"

associating to each one dedicated tags (e.g. LINUX for each and then LOGIN for Linux_Login, LOGFAIL for Linux_Logfail, and so on)

in this way in the search I can use only

tag=LINUX

having all the searches in eventtypes in a little search.

This way is a little more complicated, but more efficient and clear to maintain and use.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Holistic Visibility and Effective Alerting Across IT and OT Assets

Instead of effective and unified solutions, they’re left with tool fatigue, disjointed alerts and siloed ...

SOC Modernization: How Automation and Splunk SOAR are Shaping the Next-Gen Security ...

Security automation is no longer a luxury but a necessity. Join us to learn how Splunk ES and SOAR empower ...

Ask It, Fix It: Faster Investigations with AI Assistant in Observability Cloud

  Join us in this Tech Talk and learn about the recently launched AI Assistant in Observability Cloud. With ...