Splunk Search

I need help with my search query

Explorer

I have the follow search query:

sourcetype=linux_secure source="/var/log/*" "su: ("  | eval Date=strftime(_time, "%Y/%m/%d") | rex ".*:\d{2}\s(?<hostname>\S+)" | rex "su:\s\Sto\sroot\S\s(?<SU>\S+)"  | stats  count by Date, hostname, SU  | rename  count as "Occurrences"  | rename  SU as "Account with Escalated Privileges" | sort - Date

The regex seems wrong. I got the search from gosplunk.com and it's supposed to help detect who escalated privileges on any host in a given time range. I'm not good with regex and can't tell if this is wrong and why it's not working.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

My linux_secure data looks different in the format. This worked for my data:

sourcetype=linux_secure  "su:" | eval Date=strftime(_time, "%Y/%m/%d") | rex ".:\d{2}\s(?<hostname>\S+)" | rex "by (?<SU>[^(]+)"  | stats count by Date, hostname, SU | rename count as "Occurrences" | rename SU as "Account with Escalated Privileges" | sort - Date

View solution in original post

Motivator

@jcorkey

index=nix source=/var/log/*  "su: (" | eval Date=strftime(_time,"%Y/%m/%d") | rex field=_raw ".*:\d{2}\s(?P&lt;hostname&gt;\S+)" | rex field=_raw "su\:\s+\(\S+\s\S+\)\sroot\s\S+\s(?P&lt;SU&gt;\S+)" | stats count by Date, hostname, SU | rename count as "Occurrences" | rename SU as "Account with Escalated Privileges" | sort - Date
0 Karma

SplunkTrust
SplunkTrust

marked as code for you

0 Karma

SplunkTrust
SplunkTrust

My linux_secure data looks different in the format. This worked for my data:

sourcetype=linux_secure  "su:" | eval Date=strftime(_time, "%Y/%m/%d") | rex ".:\d{2}\s(?<hostname>\S+)" | rex "by (?<SU>[^(]+)"  | stats count by Date, hostname, SU | rename count as "Occurrences" | rename SU as "Account with Escalated Privileges" | sort - Date

View solution in original post

Explorer

This seems to be working. Thanks!

0 Karma

SplunkTrust
SplunkTrust

If this works for you, please accept it as the answer for the question so that others can know what answer worked for you and that the question does have an answer.

Thanks!!

0 Karma

Motivator

Can you paste sample event/data.

0 Karma

SplunkTrust
SplunkTrust

I edited the query to include the rex field names.
What makes you think the regex is wrong? If you run the base search by itself do you get events?

---
If this reply helps you, an upvote would be appreciated.
0 Karma