Splunk Search

How can we deal with a negation of a transaction?

danielbb
Motivator

We have a working code that captures transactions from the firewall into the windows servers and all is perfect as the code captures these transactions.

(index=wineventlog  OR 
(index=checkpoint action=Accept) 
| eval destination_ip = coalesce(Source_Network_Address,dest_ip) 
| eval action-{index}= action 
| eval src-{index}= src 
| transaction destination_ip maxspan=60s startswith=action-checkpoint="Accept" endswith=action-wineventlog="success" keeporphans=1 unifyends=1 
| search src-wineventlog = * AND src-checkpoint = * 
| lookup(s) ....
| table <fields>

However, being the cyber team, we are trying to find the negation of a transaction and we don't know where to start.

Any advice, by any chance?

Tags (2)
0 Karma

wcates1
Engager

So figure out how to do this (was not easy). You have to eval a test field with some unique host ID and the timestamp and then negate the transaction results based on that - putting the new test field together inside of the subsearch and outside of it before you do the subsearch:

index=windows* EventCode=1
| eval TESTFIELD=ip_address._time
| search NOT
[ search index=windows* (EventCode=1 OR EventCode=2 OR EventCode=3)
| transaction ip_address startswith=EventCode=1 endswith=(EventCode=2 OR EventCode=3) maxspan=12m
| eval TESTFIELD=ip_address._time
| fields TESTFIELD
| table TESTFIELD ]
| fillnull value=NULL
| table ip_address EventCode host _time TESTFIELD

richgalloway
SplunkTrust
SplunkTrust

Please explain what you mean by "negation of a transaction".

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...