Enrichment with sub-search in a certain time period by using index

[splunkerer]

Hi Folks,

I am trying to enrich my search with subsearch in the same time bucket/bin. The search can be found below.

Details:

Main search: looking for 5 times or more failed login attempts from an account/user. if login attempt get failed, userid doesn't show up, however if it can be successful on subsequent attempts, userid shows up in the logs.
Subsearch : looking for username by using userid. this username will enrich main search's username field along with the userid. 

Two complications:

1. userid is supposed to be unique, but not always, so both main search and subsearch should look for same time frame to create correct results. 

2. sometimes subsearch could not find username due to the lack of successful login, in this case I want my main main search should show result without username or fill username with NULL or so.

Note: not sure the following way is proper or not. but looks working without meeting second complication mentioned above. 

Thanks,

index="useractivity" event=login response.login=failed
| eval temp=split(userid, ":")
| eval urole=mvindex(temp,5)
| bucket _time span=15m

| join type=inner userid
    [ search index="useractivity" 
    |  eval userid_tmp=split(userid, ":") 
    |  eval userid=mvindex(userid_tmp, 0), username=mvindex(userid_tmp, 1) 
    |  bucket _time span=15m
    |  stats latest(userid) as userid by username ]


| stats values(src_ip)  values(event) count(event) as total by _time user urole userid username 
| where total >= 5

[efika]

Hi @splunkerer ,

With your permission I'll start from the beginning, with your problem statement. You wrote that "if login attempt get failed, userid doesn't show up" and "userid is supposed to be unique, but not always". 

So how do you link between the failed login events and the following successful one ? by host name or some id ?

If possible can you share some sample dataset from your dev/QA environment or something similar ?