Hey Splunkers,
in the last days I'm trying to learn and understand the principles of LISPY to understand the fllowing phenomenon. By now I can tell that I've learned a lot but still can't comprehend the behaviour of Splunk putting its LISPY queries together.
Szenario: Our analysts are working with Windows Defender Logs and therefore we are using two TAs (https://splunkbase.splunk.com/app/3734/ and https://splunkbase.splunk.com/app/5208/) to extract and normalize the data. The TA by nextpart does a renaming of the source and a automatic lookup as you can see in this props.conf
[source::...WinEventLog:Microsoft-Windows-Windows Defender/Operational]
# Default shorten to easy readable source
EVAL-source = "XmlWinEventLog:Defender"
LOOKUP-CategoryString_for_windows = windefender_signature_lookup signature_id OUTPUTNEW action, CategoryString, result, subsystem
...
I understand what is happening here so far, but now we have a strange behaviour whie running SPL on the data where we used the fields "index", "source" and "CategoryString". "CategoryString" comes as output fromthe automatic lookup. That was when i took a closer look at the LISPY and was able to locate the problem:
| SPL | LISPY | Results |
index=indexname source="XmlWinEventLog:Defender" CategoryString=action | [ AND action index::indexname [ OR source::*wineventlog:microsoft-windows-windows\ defender/operational source::xmlwineventlog:defender ] ] | No |
index=indexname SourceName="Microsoft-Windows-Windows Defender" CategoryString=action | [ AND defender index::indexname microsoft windows [ OR action source::*wineventlog:microsoft-windows-windows\ defender/operational ] ] | Yes |
As far as I understand the string "action" is not found in tsidx file as it is returned as a field value from a automatic lookup and that's why our first LISPY does not provide any data and the SPL gives back 0 results. In the second SPL where we used SourceName (not indexed) instead of Source (indexed) the LISPY looked different and worked as the string "action" is now in OR-clause and not in the AND-clause at the beginning...
My questions now are:
- As I'm a very curious guy, can someone explain this behaviour to me?
- What would / could be a good way or workaround to "fix" this so that the field "source" and "CategoryString" can be used together?
Regards,
Lombs
