Splunk Search

Search for certain adjacent events in IIS log

seekay
Engager

Greetings,

 

I've been asked to provide log data for a specific form that has been accessed over a certain time period. As the data are going to leave our organization, I want to filter it down to only the relevant data.

 

I'm looking for events in which a certain html form has been accessed. I want to display events shortly before and after, that show the same user agent.

 

I've attempted a few things, but in the latest query I attempted to utilize the map function. I'm not sure why I receive the error "Error in 'map': Did not find value for required attribute 'useragent'. "
 

 

index=iis_logs [search "https://example.com/form.html" 
| eval start=_time-15 
| eval stop=_time+30 
| eval useragent=_cs_User_Agent 
| map search="search  index=* cs_User_Agent=$useragent$ earliest=$start$ latest=$stop$"]


Edit: When I, for example, put cs_User_Agent=*Mozilla*, there are results surrounding the relevant events. But that is not the data I am looking for.

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps the _cs_User_Agent field is null, which would lead to the map command trying to search for "cs_User_Agent=".  Try putting quotes around $useragent$.

---
If this reply helps you, Karma would be appreciated.

seekay
Engager

Thank you for your response, I tried that, but the error remains the same.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...