Splunk Search

How to pass one value at a time to a search from a subsearch?

dandaily
Explorer

I am looking to run anomaly detection on failed and successful logons per user per host over a given time frame (7 days with a span of 1 day). My hope is that the search will provide the results of only anomalous counts of logons per user per host. My initial thought was to run a search similar to this:

index=foo (sourcetype=auditd type=USER_AUTH OR type=USER_ERR res=failed op!=password)  host=$host_one_at_a_time$ user=$user_one_at_a_time$ | timechart count by logon| anomalydetection

I don't know how to pass one value at a time to a search from a subsearch and would like to keep it automated. Ideally it would distinguish anomalies per host and user, but I would also be okay with just user. The goal is to identify when a user account gets crazy with successful or failed logins.

Thanks,

0 Karma

woodcock
Esteemed Legend

I do not understand your big picture but you can "pass one value at a time to a search from a[nother] search" by using the map command (although you have to turn your thinking inside out a bit).

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...