Splunk Search

Event correlation

Shuzzillay
Explorer

There's been numerous other questions that I've read through to see if a similar situation has been asked but so far (from what I've gathered) they've not matched my situation, so I figure I'd ask here.

My goal is to create an alert.

index=abc123 Operation=EventTriggered
|spath input=Data
|fields reid

 This will give me reid (relative ID). In the same index (abc123) there's events that have a unique ID (the field name is GUID). So, using the above search's reid value, I want to take that value and search for it in GUID and return events. So, if reid=xyz, I want something along the lines of:

index=abc123 GUID=xyz NOT (Operation=EventTriggered)
|rename "Parameters{}.Name" AS paramsName "Parameters{}.Value" AS paramsValue
|eval params=mvzip(paramsName,paramsValue)
|table myfields


The issue is that I don't know which value of GUID to search for until I run the first search, and the field values that I care about and want to table are generated from my second search.

My question, is, what is a good way to approach this? I don't think I can use a join since reid and GUID are different field names. In the result set of the first search I can't rename reid to GUID because the event with the recorded reid has its own GUID value. Although I can probably do some multivalue field manipulation to overcome that issue?

Could I use a subsearch somehow? Maybe in the subsearch, get the value of reid and pass it in that way?

Thanks.

Labels (5)

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure why you can't use join. Just overwrite the GUID from the first search with the reid. You don't need the GUID from the first search since you are effectively excluding it with NOT (Operation=EventTriggered).

index=abc123 Operation=EventTriggered
| spath input=Data
| eval GUID=reid
| fields GUID
| join GUID [
search index=abc123 NOT (Operation=EventTriggered)
|rename "Parameters{}.Name" AS paramsName "Parameters{}.Value" AS paramsValue
|eval params=mvzip(paramsName,paramsValue)
]
|table myfields

Shuzzillay
Explorer

You are right, and this does work (so thanks!)

I wonder if there's a way to go about it without a join, but this seems like an ideal scenario for using a join.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try this

search index=abc123 NOT (Operation=EventTriggered) [
  search index=abc123 Operation=EventTriggered
  | spath input=Data
  | eval GUID=reid
  | fields GUID ]
|rename "Parameters{}.Name" AS paramsName "Parameters{}.Value" AS paramsValue
|eval params=mvzip(paramsName,paramsValue)
|table myfields
0 Karma

inventsekar
Ultra Champion

>> The issue is that I don't know which value of GUID to search for until I run the first search, and the field values that I care about and want to table are generated from my second search.

Hi @Shuzzillay .. so, after running the first search for reid, how you will know which value of GUID to search? i mean, you will manually select the GUID or any calculations like top reid will be my GUID, etc.

0 Karma

Shuzzillay
Explorer

It won't be manual as my goal is to write an alert. I was thinking just using `fields` or any other calculation.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...