Splunk Search

Find Multiple Users With The Same Unknown Email Subject

pcyr
Engager

Scenario: I have 10 machines infected with malware. The believed infection source is email, I am attempting to create a search to find if any emails with the same subject line or sender have been sent to all 10 individuals.

Basis of search is below, I am just wondering what operator would be used to compare a field to itself and only return the results which are present in the logs of all users .

index=email sourcetype=email
recipient= user1 OR recipient=user2 OR recipient=user3 AND subject="unknown subject that is the same for all recipients"

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the stats command to group events by subject then use where to show only those common to all 10 recipients.

index=email sourcetype=email
(recipient= user1 OR recipient=user2 OR recipient=user3) AND subject=*
| stats dc(recipient) as recipCount by subject
| where recipCount=10

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

pcyr
Engager

Thanks guys, dc worked just as it should have.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the stats command to group events by subject then use where to show only those common to all 10 recipients.

index=email sourcetype=email
(recipient= user1 OR recipient=user2 OR recipient=user3) AND subject=*
| stats dc(recipient) as recipCount by subject
| where recipCount=10

 

---
If this reply helps you, Karma would be appreciated.

manjunathmeti
SplunkTrust
SplunkTrust

Hi @pcyr,
Use dc OR distinct_count with stats to count distinct values of field recipient.

index=email sourcetype=email recipient IN (user1,user2,user3,user4,...,user10) subject="unknown subject that is the same for all recipients"
| stats dc(recipient) as count 
| where count=10

 

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...