Splunk Search

Enrichment with sub-search in a certain time period by using index

splunkerer
Path Finder

Hi Folks,

I am trying to enrich my search with subsearch in the same time bucket/bin. The search can be found below.

Details:

Main search: looking for 5 times or more failed login attempts from an account/user. if login attempt get failed, userid doesn't show up, however if it can be successful on subsequent attempts, userid shows up in the logs.
Subsearch : looking for username by using userid. this username will enrich main search's username field along with the userid. 

Two complications:


1. userid is supposed to be unique, but not always, so both main search and subsearch should look for same time frame to create correct results. 

2. sometimes subsearch could not find username due to the lack of successful login, in this case I want my main main search should show result without username or fill username with NULL or so.

Note: not sure the following way is proper or not. but looks working without meeting second complication mentioned above. 

Thanks,

 

 

 

index="useractivity" event=login response.login=failed
| eval temp=split(userid, ":")
| eval urole=mvindex(temp,5)
| bucket _time span=15m

| join type=inner userid
    [ search index="useractivity" 
    |  eval userid_tmp=split(userid, ":") 
    |  eval userid=mvindex(userid_tmp, 0), username=mvindex(userid_tmp, 1) 
    |  bucket _time span=15m
    |  stats latest(userid) as userid by username ]


| stats values(src_ip)  values(event) count(event) as total by _time user urole userid username 
| where total >= 5
Labels (1)
0 Karma

efika
Communicator

Hi @splunkerer ,

With your permission I'll start from the beginning, with your problem statement. You wrote that "if login attempt get failed, userid doesn't show up" and "userid is supposed to be unique, but not always". 

So how do you link between the failed login events and the following successful one ? by host name or some id ?

If possible can you share some sample dataset from your dev/QA environment or something similar ?

 

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...