Splunk Search

Enrichment with sub-search in a certain time period by using index

splunkerer
Path Finder

Hi Folks,

I am trying to enrich my search with subsearch in the same time bucket/bin. The search can be found below.

Details:

Main search: looking for 5 times or more failed login attempts from an account/user. if login attempt get failed, userid doesn't show up, however if it can be successful on subsequent attempts, userid shows up in the logs.
Subsearch : looking for username by using userid. this username will enrich main search's username field along with the userid. 

Two complications:


1. userid is supposed to be unique, but not always, so both main search and subsearch should look for same time frame to create correct results. 

2. sometimes subsearch could not find username due to the lack of successful login, in this case I want my main main search should show result without username or fill username with NULL or so.

Note: not sure the following way is proper or not. but looks working without meeting second complication mentioned above. 

Thanks,

 

 

 

index="useractivity" event=login response.login=failed
| eval temp=split(userid, ":")
| eval urole=mvindex(temp,5)
| bucket _time span=15m

| join type=inner userid
    [ search index="useractivity" 
    |  eval userid_tmp=split(userid, ":") 
    |  eval userid=mvindex(userid_tmp, 0), username=mvindex(userid_tmp, 1) 
    |  bucket _time span=15m
    |  stats latest(userid) as userid by username ]


| stats values(src_ip)  values(event) count(event) as total by _time user urole userid username 
| where total >= 5
Labels (1)
0 Karma

efika
Communicator

Hi @splunkerer ,

With your permission I'll start from the beginning, with your problem statement. You wrote that "if login attempt get failed, userid doesn't show up" and "userid is supposed to be unique, but not always". 

So how do you link between the failed login events and the following successful one ? by host name or some id ?

If possible can you share some sample dataset from your dev/QA environment or something similar ?

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...