Splunk Search

Return Timestamp from inner and outter search

shayvdee
Explorer

Hi,
I am trying to create a search that finds two sequential events. So far I have:

index=wineventlog EventCode=4624 [ search index=wineventlog EventCode=4625 | eval earliest=_time | eval latest=_time+600 | fields earliest latest ComputerName ]

This works and returns successful windows logins that follow a failed login within a 10min period. What I want to do though is return a table that shows the time that the first event occurred and the time that the second triggering event occurred. I tried appending:

| table ComputerName earliest _time

But the earliest field comes back blank when I want that to be showing the time stamp fo the event that matched the subsearch.

Any help would be appreciated. Thanks.

0 Karma
1 Solution

nareshinsvu
Builder

Are you trying to match anything from your sub-search? if not, can you try this?

index=wineventlog earliest="-10m@m" latest="now" EventCode=4624 OR EventCode=4625 | fields _time EventCode ComputerName 

View solution in original post

0 Karma

nareshinsvu
Builder

Are you trying to match anything from your sub-search? if not, can you try this?

index=wineventlog earliest="-10m@m" latest="now" EventCode=4624 OR EventCode=4625 | fields _time EventCode ComputerName 
0 Karma

shayvdee
Explorer

Hi @nareshinsvu

Thanks for your answer.

I need to match the ComputerName from the subsearch and then use the time from the subsearch to find other events in the same time period.

In the example, I want to find all successful logins over the last week that occur within 10min of a failed login on the same computer.

Thanks.

0 Karma

nareshinsvu
Builder

Sorry, I read it wrong. Can you try this? tweak the time format according to your need. Hope this should help now?

index=wineventlog EventCode=4624 OR EventCode=4625 
| eval failed_time=if(EventCode=4625,strftime(_time,"%Y-%m-%dT%H:%M:%S"),"") 
|eval Success_time=if(EventCode=4624,strftime(_time,"%Y-%m-%dT%H:%M:%S"),"") 
| stats list(EventCode) as EventCode range(_time) AS duration values(failed_time) as failed_time values(Success_time) as Success_time BY ComputerName 
| rex field=duration mode=sed "s/\..*$//" 
| where duration <600

shayvdee
Explorer

Thanks. Not quite working yet, but I think you have pointed me down the right track.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...