Getting a value from subsearch

[tmontney]

(index="myindex" OR index="wineventlog") AND ((host=MYSERVER1 OR host=MYSERVER2) AND (EventCode=20274 OR EventCode=20271)) OR ((fw="192.168.10.20") AND (msg="User logged in" OR msg="User failed to logon"))
| rename _time AS earliest
| rename EventCode AS tEventCode
| eval Username=case(tEventCode=20274, mvindex(split(body, " "), 5), tEventCode=20271, mvindex(split(body, " "), 3), 1=1, usr)
| eval preSource=case(tEventCode=20271, mvindex(split(body, " "), 6), tEventCode=20274, mvindex(split(body, " "), 14), 1=1, src)
| eval Source=[search index="wineventlog" EventCode=6278 Connection_Request_Policy_Name="MYPOLICY" | eval SubSource=case(EventCode=="20274" AND Account_Name==Username AND earliest==_time, Calling_Station_Identifier) | eval SubSource=case(SubSource="", Source) | fields SubSource | rename SubSource as query]
| eval FSource=case(like(Source, "10.%"), Source, like(Source,"172.16.%"), Source, like(Source,"192.168.%"), Source, 1=1, "http://". Source .".ipaddress.com")
| sort Date Time Reason
| table Username Reason FSource

Get the following error.

Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'. 

Basically, if the main search gets a result that's EventCode 20274, it's to perform another search looking for an event 6278 with the same account name and date/time as the 20274 event. I'm looking to extract the IP address in 6278, as it isn't contained in 20274.

This 'eval' is called near the end of my query, before I sort and table everything.

Event 20274 is when a user successfully authenticates with a RADIUS server. It contains the username and private IP address of the session. The private IP address is the IP assigned to the user, from a DHCP pool. The problem is just that, it's a private IP. If the user failed to authenticate, then it gives the public IP. If you want to know the public IP of a successful RADIUS authentication, you need to look at event 6278 (NAP policy). On successful login, the user requests a NAP policy, one being RADIUS. The NAP event lists the public IP that requested it.

tl;dr I want to correlate 20274's with 6278's, as both have information I need. Where 20274 exists, 6278 exists.

The other issue is that there really isn't that much between the two. There's no direct reference. However, since they both happen at the same time, I'd use time and username assigned to match them.

[somesoni2]

I guess you would need join here (due to already multiple data sources in base search, can't think of an easy way to merge there). Give this a try

(index="myindex" OR index="wineventlog") ((host=SERVER1 OR host=SERVER2) AND (EventCode=20274 OR EventCode=20271)) 
OR ((fw="192.168.1.33") AND (msg="User login successful" OR msg="User login failed - invalid password")) 
OR ((host=SERVER1 OR host=SERVER2) EventCode=6278 Connection_Request_Policy_Name="PBDC VPN Connections")
 | eval joinEventCode=if(EventCode=20274,6278,null)
 | eval Username=case(EventCode=20274, mvindex(split(body, " "), 5), EventCode=20271, mvindex(split(body, " "), 3), 1=1, usr)
 | eval preSource=case(EventCode=20271, mvindex(split(body, " "), 6), EventCode=20274, mvindex(split(body, " "), 14), 1=1, src)
 | join _time index Username joinEventCode [search index="wineventlog" EventCode=6278 Connection_Request_Policy_Name="PBDC VPN Connections" | fields _time index Account_Name EventCode Calling_Station_Identifier| rename Account_Name as Username EventCode as joinEventCode ]
 | eval Source=case(isnull(Calling_Station_Identifier) OR Calling_Station_Identifier="", Source)
 | eval FSource=case(like(Source, "10.%"), Source, like(Source,"172.16.%"), Source, like(Source,"192.168.%"), Source, 1=1, "http://". Source .".ipaddress.com")
 | sort Date Time Reason
 | table Username Reason FSource

[DalJeanis]

Looks plausible. Needs comma in rename command, IIRC.

Not sure why index is in the join...?

My preference would be to change 1=1 to true() , and to align the case statements to the same order.

Also, Source needs to get Calling_Station_Identifier when it is present.

I don't see where Date, Time, or Reason are coming from, or why the table command would remove the Date and Time if that's how they are going to sort.

[tmontney]

Must have left those by mistake. The eval references are normally there.

[tmontney]

Yeah, there should be 1 to 1. Basically, if the event id in the main search is 20274, I search event code 6278 (as subsearch) to replace the IP address found (in 20274). The IP in 20274 is always private, and the 6278 event has the public ip.