Splunk Search

How can we deal with a negation of a transaction?


We have a working code that captures transactions from the firewall into the windows servers and all is perfect as the code captures these transactions.

(index=wineventlog  OR 
(index=checkpoint action=Accept) 
| eval destination_ip = coalesce(Source_Network_Address,dest_ip) 
| eval action-{index}= action 
| eval src-{index}= src 
| transaction destination_ip maxspan=60s startswith=action-checkpoint="Accept" endswith=action-wineventlog="success" keeporphans=1 unifyends=1 
| search src-wineventlog = * AND src-checkpoint = * 
| lookup(s) ....
| table <fields>

However, being the cyber team, we are trying to find the negation of a transaction and we don't know where to start.

Any advice, by any chance?

Tags (2)
0 Karma


So figure out how to do this (was not easy). You have to eval a test field with some unique host ID and the timestamp and then negate the transaction results based on that - putting the new test field together inside of the subsearch and outside of it before you do the subsearch:

index=windows* EventCode=1
| eval TESTFIELD=ip_address._time
| search NOT
[ search index=windows* (EventCode=1 OR EventCode=2 OR EventCode=3)
| transaction ip_address startswith=EventCode=1 endswith=(EventCode=2 OR EventCode=3) maxspan=12m
| eval TESTFIELD=ip_address._time
| fields TESTFIELD
| table TESTFIELD ]
| fillnull value=NULL
| table ip_address EventCode host _time TESTFIELD


Please explain what you mean by "negation of a transaction".

If this reply helps you, an upvote would be appreciated.
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!