Splunk Search

Comparing Field Names and Values

dctopper
Explorer

Hi,

I've run into a problem: Splunk ingests Window's security events in such a way that field names may occur more than once and have different values assigned. (e.g., 'Security_ID' can equate to any of the following: alpha-numeric account SID, actual account name, or even account group) I want to compose a search that compares the SIDs from two different events and gives results if a match is found. Something like:

Search for two events, A & B, occurring within 5 seconds of each other, where A possesses an alpha-numeric SID that exactly matches an alpha-numeric SID listed in event B.

The alpha-numeric value is not known in advance. Any insight on how to do this? Your help is much appreciated!

-Dave

0 Karma
1 Solution

kristian_kolb
Ultra Champion

You probably want to look at a certain SID in the events, either the first or the second, and compare that SID across events. Since the Security_ID is present more than once in these events, Splunk creates what is called a multivalued field. The individual values of the field can be accessed with various functions. You can then build so-called transactions based on this, e.g.

your search for events | eval sid2 = mvindex(Security_ID, 1) | transaction sid2 maxpause=5s 

Read more here;

http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Transaction

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

/K

View solution in original post

kristian_kolb
Ultra Champion

You probably want to look at a certain SID in the events, either the first or the second, and compare that SID across events. Since the Security_ID is present more than once in these events, Splunk creates what is called a multivalued field. The individual values of the field can be accessed with various functions. You can then build so-called transactions based on this, e.g.

your search for events | eval sid2 = mvindex(Security_ID, 1) | transaction sid2 maxpause=5s 

Read more here;

http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Transaction

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

/K

dctopper
Explorer

Exactly what I needed - thanks again!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...