Splunk Search

How to pass one value at a time to a search from a subsearch?


I am looking to run anomaly detection on failed and successful logons per user per host over a given time frame (7 days with a span of 1 day). My hope is that the search will provide the results of only anomalous counts of logons per user per host. My initial thought was to run a search similar to this:

index=foo (sourcetype=auditd type=USER_AUTH OR type=USER_ERR res=failed op!=password)  host=$host_one_at_a_time$ user=$user_one_at_a_time$ | timechart count by logon| anomalydetection

I don't know how to pass one value at a time to a search from a subsearch and would like to keep it automated. Ideally it would distinguish anomalies per host and user, but I would also be okay with just user. The goal is to identify when a user account gets crazy with successful or failed logins.


0 Karma

Esteemed Legend

I do not understand your big picture but you can "pass one value at a time to a search from a[nother] search" by using the map command (although you have to turn your thinking inside out a bit).

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...