Splunk Search

How to achieve results only if another event is NOT true for the user?

aikn061
Explorer

Hi All,

I already have a search that gives me a result.  But what I desire to have is we want the results only if another event is NOT true for the user.

So for example below gives me result:

EventID=4625 earliest=-4h@h latest=-3h@h | table User IPAddress EventID Message

Desire is to only show results if there was no 4724 for a specific period.  Would I do it something like this?

EventID=4625 earliest=-4h@h latest=-3h@h | table User IPAddress EventID Message earliest=-4h@h latest=-3h@h

| append [search NOT EventID=4724 earliest=-7d@d latest=now ]

 

 

Labels (6)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Just throwing this out as an untested idea.

(EventID=2624 OR EventID=4625) earliest=-4h@h latest=-3h@h 
```Count the number of 4624 events for each user```
| eventstats sum(eval(EventID=4624)) as unwanted by user
```Keep the users who have no 4624 events```
| where unwanted = 0
```We're only interested in event 4625```
| where EventID=4625
| table User IPAddress EventID Message
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...