Splunk Search

Search Events with "\" character

jnahuelperez35
Path Finder

I was making some SQL dashboard and i can't use some variables cause one of them is the kerberos USER that comes like:
"MyDomain\User1"
MyDomain\User2"
MyDomain\User3"
MyDomain\User4"

My search is

index="mssql" sourcetype="mssql:audit"
| eval user=lower(server_principal_name)
| search user="$m_user$"
| table _time name user statement

Where m_user is a dropdown input that populate this way:

index="mssql" sourcetype="mssql:audit" statement!="" statement!="--*" server_principal_name!="*SYSTEM"
| eval user=lower(server_principal_name)
| dedup user

(I use a lower function cause server_principal_name can be "MyDomain\USer1" or ""MyDomain\user1")

The thing is when m_user get's the value (for example) "MyDomain\User1" the search didn't find result, but if i look for "MyDomain\user1" the search finds the events. I was trying to do a eval thing like:

index="mssql" sourcetype="mssql:audit"
    | eval user=lower(server_principal_name)
    | search user="$m_user$"
    | eval user=replace(user,".+\\.+","\\\\")
    | table _time name user statement

without success. Some idea?

0 Karma
1 Solution

wildcats12
Explorer

In your original search, try changing:
| search user="$m_user$"
to:
| where user="$m_user$"

The where command interprets quoted strings as literals and should do a better job of comparing strings with an escape character.

View solution in original post

niketn
Legend

@jnahuelperez35, search match is not case-sensitive. So there is no need for | eval user=lower(server_principal_name) in Dropdown query or in your search. Also it is better to filter results upfront in the base search when you pull events from raw data, rather than filtering afterwards i.e.

index="mssql" sourcetype="mssql:audit" server_principal_name=$m_user|s$
| table _time name user statement

You need to use token filter to use the token as String. In this case server_principal_name=$m_user|s$
Following is a run anywhere example based on Sample Data and code provided.

<form>
  <label>Dropdown with backslash</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="m_user" searchWhenChanged="true">
      <label>Select User</label>
      <choice value="*">All</choice>
      <fieldForLabel>user</fieldForLabel>
      <fieldForValue>user</fieldForValue>
      <search>
        <query>| makeresults
| fields - _time
| eval user="MyDomain\User1;MyDomain\User2;MyDomain\User3;MyDomain\User4"
| makemv user delim=";"
| mvexpand user
| dedup user</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
|  fields - _time
| eval user="MyDomain\User1;MyDomain\User2;MyDomain\User3;MyDomain\User4"
| makemv user delim=";"
| mvexpand user
| search user=$m_user|s$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

wildcats12
Explorer

In your original search, try changing:
| search user="$m_user$"
to:
| where user="$m_user$"

The where command interprets quoted strings as literals and should do a better job of comparing strings with an escape character.

jnahuelperez35
Path Finder

thanks for the answer
using where i can search for "mydomain\user" but i can't use with "*" character that means "hey ,give me events of any user".
Any idea?

0 Karma

wildcats12
Explorer

Yes, you can still use a wildcard search within a where, but the syntax is different. Try the like() function:
| where like(user,"%")

The "%" character is the equivalent of "*" within where, eval, etc when used inside like().

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...