Splunk Search
Highlighted

How to lookup value with wildcard?

Builder

Hi.
for example, i have that log:
Apr 26 12:04:38 centos7LAB sudo: qweqwe : TTY=pts/4 ; PWD=/home/qweqwe ; USER=root ; COMMAND=/bin/chmod +x 436346
and i want to make filter by command by lookup
kinda sourcetype=sudo | stats count by host _time src_user src TTY PWD USER dest COMMAND action | lookup suspicious_commands COMMAND AS COMMAND OUTPUT COMMAND AS COMMAND | where COMMAND!="" | sort - _time

I used match_type = WILDCARD(COMMAND)

my lookup look like it:

COMMAND
*chmod*

Open my screenshot and instead of *chmod* I want see /bin/chmod +x 436346

Or what you know other solutions to make what I want?

0 Karma
Highlighted

Re: How to lookup value with wildcard?

SplunkTrust
SplunkTrust

Do
lookup suspicious_commands COMMAND OUTPUT COMMAND AS cmd_match | where isnotnull(cmd_match) | fields - cmd_match

Highlighted

Re: How to lookup value with wildcard?

Builder

It works, too!
Explain me what you did.
I mean:
lookup suspiciouscommands `COMMAND OUTPUT COMMAND AS cmdmatch`

0 Karma
Highlighted

Re: How to lookup value with wildcard?

SplunkTrust
SplunkTrust

If this isnt going to be a large lookup then yes the inputlookup pattern works. I tend to stick with the normal lookup pattern. Your original search stomped the original command field. This just outputs the field you matched on to it's own name then looks for where it is not null. AKA found a match.

0 Karma
Highlighted

Re: How to lookup value with wildcard?

Path Finder

Is the lookup only used as a list of things to search for? If yes, you can try using a query like this instead
sourcetype=sudo [| inputlookup suspicious_commands ] | stats count by host _time src_user src TTY PWD USER dest COMMAND action | sort - _time

View solution in original post

Highlighted

Re: How to lookup value with wildcard?

Builder

It works! Thank you!
Will be nice if you will explain a bit why it works, cause i have some triggers in my head.

0 Karma
Highlighted

Re: How to lookup value with wildcard?

Path Finder

So when a subsearch is used in a search command (and the search command is by default the first command of a query), the subsearch expands it's results into additional search terms, where the fields of a row/event are combined with "AND" and multiple rows/events are combined with "OR".

So if you have a lookup like
COMMAND
*chmod*
*chown*

then [| inputlookup suspicious_commands] will expand into ( (COMMAND="*chmod*") OR (COMMAND="*chown*") ).

You can actually see what exactly something would expand to by using the format command, like | inputlookup suspicious_commands| format. And you can use pretty much anything for the subsearch, not just lookups.

0 Karma