Splunk Search

How can we deal with a negation of a transaction?

danielbb
Motivator

We have a working code that captures transactions from the firewall into the windows servers and all is perfect as the code captures these transactions.

(index=wineventlog  OR 
(index=checkpoint action=Accept) 
| eval destination_ip = coalesce(Source_Network_Address,dest_ip) 
| eval action-{index}= action 
| eval src-{index}= src 
| transaction destination_ip maxspan=60s startswith=action-checkpoint="Accept" endswith=action-wineventlog="success" keeporphans=1 unifyends=1 
| search src-wineventlog = * AND src-checkpoint = * 
| lookup(s) ....
| table <fields>

However, being the cyber team, we are trying to find the negation of a transaction and we don't know where to start.

Any advice, by any chance?

Tags (2)
0 Karma

wcates1
Engager

So figure out how to do this (was not easy). You have to eval a test field with some unique host ID and the timestamp and then negate the transaction results based on that - putting the new test field together inside of the subsearch and outside of it before you do the subsearch:

index=windows* EventCode=1
| eval TESTFIELD=ip_address._time
| search NOT
[ search index=windows* (EventCode=1 OR EventCode=2 OR EventCode=3)
| transaction ip_address startswith=EventCode=1 endswith=(EventCode=2 OR EventCode=3) maxspan=12m
| eval TESTFIELD=ip_address._time
| fields TESTFIELD
| table TESTFIELD ]
| fillnull value=NULL
| table ip_address EventCode host _time TESTFIELD

richgalloway
SplunkTrust
SplunkTrust

Please explain what you mean by "negation of a transaction".

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...