Splunk Search

How can we deal with a negation of a transaction?


We have a working code that captures transactions from the firewall into the windows servers and all is perfect as the code captures these transactions.

(index=wineventlog  OR 
(index=checkpoint action=Accept) 
| eval destination_ip = coalesce(Source_Network_Address,dest_ip) 
| eval action-{index}= action 
| eval src-{index}= src 
| transaction destination_ip maxspan=60s startswith=action-checkpoint="Accept" endswith=action-wineventlog="success" keeporphans=1 unifyends=1 
| search src-wineventlog = * AND src-checkpoint = * 
| lookup(s) ....
| table <fields>

However, being the cyber team, we are trying to find the negation of a transaction and we don't know where to start.

Any advice, by any chance?

Tags (2)
0 Karma


So figure out how to do this (was not easy). You have to eval a test field with some unique host ID and the timestamp and then negate the transaction results based on that - putting the new test field together inside of the subsearch and outside of it before you do the subsearch:

index=windows* EventCode=1
| eval TESTFIELD=ip_address._time
| search NOT
[ search index=windows* (EventCode=1 OR EventCode=2 OR EventCode=3)
| transaction ip_address startswith=EventCode=1 endswith=(EventCode=2 OR EventCode=3) maxspan=12m
| eval TESTFIELD=ip_address._time
| fields TESTFIELD
| table TESTFIELD ]
| fillnull value=NULL
| table ip_address EventCode host _time TESTFIELD


Please explain what you mean by "negation of a transaction".

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...