I need to do a search where I only display results where the Arguments, Command fields in events DOES NOT contain a value in the scheduled_tasks lookup table. Where it is going wrong? Thank you!
My query is:
(index IN (index1, index2)) EventCode=4698 NOT [|inputlookup scheduled_tasks |fields Arguments, Command] | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Command,Arguments |dedup Command,Arguments
My lookup table:
I rewrote my query:
EventCode=4698 | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |search NOT [|inputlookup scheduled_task |fields Arguments, Command]|table Task_Name, ComputerName,Command,_time,Arguments, Account_Name
This works for me 🙂
HI @Dalador
try like this:
(index IN (index1, index2)) EventCode=4698 [inputlookup scheduled_tasks |fields Arguments, Command | format "(" "(" "AND" ")" "NOT" ")"] | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Command,Arguments |dedup Command,Arguments
Karma given or solution confirmation appreciated
Alessandro
Same result 😞
hey @Dalador
can you show me the results of this search?
|inputlookup scheduled_tasks |fields Arguments, Command | format "(" "(" "AND" ")" "NOT" ")"
if the results is 0 please check if the permission of the lookup is set on global.
I rewrote my query:
EventCode=4698 | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |search NOT [|inputlookup scheduled_task |fields Arguments, Command]|table Task_Name, ComputerName,Command,_time,Arguments, Account_Name
This works for me 🙂