Splunk Search

Find Multiple Users With The Same Unknown Email Subject

pcyr
Engager

Scenario: I have 10 machines infected with malware. The believed infection source is email, I am attempting to create a search to find if any emails with the same subject line or sender have been sent to all 10 individuals.

Basis of search is below, I am just wondering what operator would be used to compare a field to itself and only return the results which are present in the logs of all users .

index=email sourcetype=email
recipient= user1 OR recipient=user2 OR recipient=user3 AND subject="unknown subject that is the same for all recipients"

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the stats command to group events by subject then use where to show only those common to all 10 recipients.

index=email sourcetype=email
(recipient= user1 OR recipient=user2 OR recipient=user3) AND subject=*
| stats dc(recipient) as recipCount by subject
| where recipCount=10

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

pcyr
Engager

Thanks guys, dc worked just as it should have.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the stats command to group events by subject then use where to show only those common to all 10 recipients.

index=email sourcetype=email
(recipient= user1 OR recipient=user2 OR recipient=user3) AND subject=*
| stats dc(recipient) as recipCount by subject
| where recipCount=10

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

manjunathmeti
Champion

Hi @pcyr,
Use dc OR distinct_count with stats to count distinct values of field recipient.

index=email sourcetype=email recipient IN (user1,user2,user3,user4,...,user10) subject="unknown subject that is the same for all recipients"
| stats dc(recipient) as count 
| where count=10