Splunk Search

How to use OR operator between subsearch and fields?

splunkxorsplunk
Explorer

Hey Splunkers,

 

I have the following search but it is not working as expected. What I am trying to achieve is if one of the conditions matches I will table out some fields.

condition 1 : if user_action="Update*"

OR 

Condition 2:  within each 5 min bucket, if any user has access more than 400 destination in the same index, index1

but it doesn't work. How can I check both condition on the same search? 

Thanks in advanced!

 

 

index=index1
``` condition 1 ```
( user_action="Update*" )

OR
``` condition 2 ```
(
[search index=index1 NOT user IN ("system*", "nobody*")
| bin _time span=5m
| stats values(dest) count by _time, user
| where count > 400 ]
)

| table _time, user, dest

 

 

 

Labels (2)
0 Karma
1 Solution

johnhuang
Motivator

Either one of these:

index=index1 user_action="Update"
| append [search index=index1 NOT user IN ("system*", "nobody*")
| bucket _time span=5m
| stats count as event_ct values(dest) AS dest BY _time user
| where count>400]
| table _time user dest

index=index1
| bucket _time span=5m
| eventstats count AS event_ct BY _time user
| search event_ct>400 OR user_action="Update"
| table _time user dest

View solution in original post

splunkxorsplunk
Explorer

It worked! Thanks Johnhuang!

johnhuang
Motivator

Just literally replace the or with

 | append 

And remove the next set of parentheses 

0 Karma

splunkxorsplunk
Explorer

Thanks for quick reply! but it didn't work

0 Karma

johnhuang
Motivator

Either one of these:

index=index1 user_action="Update"
| append [search index=index1 NOT user IN ("system*", "nobody*")
| bucket _time span=5m
| stats count as event_ct values(dest) AS dest BY _time user
| where count>400]
| table _time user dest

index=index1
| bucket _time span=5m
| eventstats count AS event_ct BY _time user
| search event_ct>400 OR user_action="Update"
| table _time user dest
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...