Splunk Search

Search for certain adjacent events in IIS log

seekay
Engager

Greetings,

 

I've been asked to provide log data for a specific form that has been accessed over a certain time period. As the data are going to leave our organization, I want to filter it down to only the relevant data.

 

I'm looking for events in which a certain html form has been accessed. I want to display events shortly before and after, that show the same user agent.

 

I've attempted a few things, but in the latest query I attempted to utilize the map function. I'm not sure why I receive the error "Error in 'map': Did not find value for required attribute 'useragent'. "
 

 

index=iis_logs [search "https://example.com/form.html" 
| eval start=_time-15 
| eval stop=_time+30 
| eval useragent=_cs_User_Agent 
| map search="search  index=* cs_User_Agent=$useragent$ earliest=$start$ latest=$stop$"]


Edit: When I, for example, put cs_User_Agent=*Mozilla*, there are results surrounding the relevant events. But that is not the data I am looking for.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps the _cs_User_Agent field is null, which would lead to the map command trying to search for "cs_User_Agent=".  Try putting quotes around $useragent$.

---
If this reply helps you, Karma would be appreciated.

seekay
Engager

Thank you for your response, I tried that, but the error remains the same.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...