I need help with my search query

[jcorkey]

I have the follow search query:

sourcetype=linux_secure source="/var/log/*" "su: ("  | eval Date=strftime(_time, "%Y/%m/%d") | rex ".*:\d{2}\s(?<hostname>\S+)" | rex "su:\s\Sto\sroot\S\s(?<SU>\S+)"  | stats  count by Date, hostname, SU  | rename  count as "Occurrences"  | rename  SU as "Account with Escalated Privileges" | sort - Date

The regex seems wrong. I got the search from gosplunk.com and it's supposed to help detect who escalated privileges on any host in a given time range. I'm not good with regex and can't tell if this is wrong and why it's not working.

[sbbadri]

@jcorkey

index=nix source=/var/log/*  "su: (" | eval Date=strftime(_time,"%Y/%m/%d") | rex field=_raw ".*:\d{2}\s(?P<hostname>\S+)" | rex field=_raw "su\:\s+\(\S+\s\S+\)\sroot\s\S+\s(?P<SU>\S+)" | stats count by Date, hostname, SU | rename count as "Occurrences" | rename SU as "Account with Escalated Privileges" | sort - Date

[DalJeanis]

marked as code for you

[cpetterborg · Accepted solution]

My linux_secure data looks different in the format. This worked for my data:

sourcetype=linux_secure  "su:" | eval Date=strftime(_time, "%Y/%m/%d") | rex ".:\d{2}\s(?<hostname>\S+)" | rex "by (?<SU>[^(]+)"  | stats count by Date, hostname, SU | rename count as "Occurrences" | rename SU as "Account with Escalated Privileges" | sort - Date

[jcorkey]

This seems to be working. Thanks!

[cpetterborg]

If this works for you, please accept it as the answer for the question so that others can know what answer worked for you and that the question does have an answer.

Thanks!!

[sbbadri]

Can you paste sample event/data.

[richgalloway]

I edited the query to include the rex field names.
What makes you think the regex is wrong? If you run the base search by itself do you get events?