How to find common field values in different action?

[navan1]

Hello All,

I want to create an alert to find certain actions done by users from same Index.

Index= myindex

sourcetype= mysourcetype

action = "session Start" and action=user added

Note : From the above actions, the common field are "SessionID"  and user information is only in action=user added.

 How to find who started the session based on time? 
|table sessionID user src_host  src_ip _time

[gcusello]

Hi @navan1 ,

if the fields are the ones you described it's a simple search:

index= myindex sourcetype= mysourcetype (action = "session Start" OR action="user added")
| stats 
   dc_action) AS action_count 
   values(action) AS action
   values(user) AS user
   values(src_host) AS src_host
   values(src_ip) AS src_ip
   earliest(_time) AS _time
   BY SessionID
| where action_count>1
| table sessionID user src_host src_ip _time

Ciao.

Giuseppe

[ITWhisperer]

| stats list(user) as user list(src_host) as src_host list(src_ip) as src_ip list(_time) as _time by sessionID 

[navan1]

If I am using below query the time format is not coming in human readable format. See below,

| stats list(user) as user list(src_host) as src_host list(src_ip) as src_ip list(_time) as _time by sessionID

1688126033

1688125889

1688125889

And is there any way to print the actions separately?

[dural_yyz]

| convert ctime(_time) as Time