Splunk Search

Conditional If statement in search

jcrensh
Explorer

All,

I have a search that is looking for two specific events. One is for new 2008 OS's and up, the other is 2003 OS's and below.

The problem that I am seeing is that the difference between the two log formats is the mufti-valued Account_Name in the 2008 Os's on up (event id 4624). I can solve the problem by looking for the second value of Account_Name, but when I do that, the results for event id 528 fail to pass the eval test and never show in the results.

It seems that I need a conditional if statement to only eval the Account_Name value if the event id is 4624 present first. I also been toying with the idea of having a count of repeated Account_Name and User_Name values per host (so if user X logs in multiple times, then I would only see one entry per host for that user with a total amount of connections), but not sure where in the search statement that "count" would need to occur.

Below is my current search string. Any help would be greatly appreciated.

source="wineventlog:security" (EventCode="4624" OR EventCode="528") (Logon_Type="2" OR Logon_Type="10") | eval Account_Name=mvindex(Account_Name, -1) | search Account_Name!=scom* AND Account_Name!=esx* | table host, EventCode, User_Name, Account_Name, Source_Network_Address, _time, Logon_Type | sort by host

Tags (3)
0 Karma

bbingham
Builder

I think I understand what you are trying to do, just to rephrase, IF event_id=4624, you want account_name to be set to the 2nd value in the multi value field account_name, otherwise you want it to remain the value it's already set to?

something like:

|eval Account_Name=if(EventCode="4624",mvindex(Account_Name, -1),Account_Name)|
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...