Splunk Search

How to count the the number of elements in a fields after performing a set difference against other events?

doksu
Contributor

How could the number of elements in a tuple of fields be counted after performing a set difference against the other events?

A trivial example:

Fields: user, src, dest, app
EventA: (alice, host1, host3, sso)
EventB: (alice, host2, host3, sshd)
EventC: (alice, host1, host3, sshd)

The set difference of EventA and the other two events above would be the set: (sso) with a count of 1.

Using an imaginary stats function, it might look something like this:

... | eventstats setdiff(src dest app) as difference by user | eval count=mvcount(difference)

woodcock
Esteemed Legend

Is this close enough?

 ... | eventstats mode(*) AS mode_* BY user | eval deviant_src=if((src==mode_src),null(),src) | eval deviant_dest=if((dest==mode_dest),null(),dest) | eval deviant_app=if((app==mode_app),null(),app) | stats values(deviant*) count(deviant*) BY user
0 Karma

doksu
Contributor

Thanks for your answer woodcock. It's quite close and a really interesting answer but it looks like it would only apply the operation to the most common element for each field. Maybe I should submit an RFE?

0 Karma

woodcock
Esteemed Legend

Are you sure the answer to your example shouldn't be: (host2,sso)?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...