Splunk Search

Simplifying/combining queries

OzzMann80
Engager

Howdy, Im fairly new to splunk and couldnt google the answer I wanted to Here we go. 

I am trying to simplify my queries and filter down the search results better.

Current example query: 

 

index=myindex
| search (EventCode=4663 OR EventCode=4660) OR (EventID=2 OR EventID=3 OR EventID=11) OR (Processes="*del*.exe" OR Processes="*rm*.exe" OR Processes="*rmdir*.exe") process!="C:\\Windows\\System32\\svchost.exe" process!="C:\\Program Files\\Microsoft Advanced Threat Analytics\\Gateway\\Microsoft.Tri.Gateway.exe"  process!="C:\\Program Files\\Common Files\\McAfee\\*" process!="C:\\Program Files\\McAfee*" process!="C:\\Windows\\System32\\enstart64.exe" process!="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" process!="C:\\Program Files\\Windows\\Audio\\EndPoint\\3668cba\\cc\\x64\\AudioManSrv.exe"
| table  _time, source, subject, object_file_path, SubjectUserName, process, result

 

This is an just an example, I do this same way for multiple different fields, indexs 

I know its not the most efficient way of doing it but I dont know any better ways. Usually Ill start broad and whittle down the things I know I'm not looking for.  Is there either a way to simplify this (I could possibly do regex but im not really good at that) or something else like this to make my life easier? such as combining all the results I want to filter for one field.

Any and all help/criticism is appreciated.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Not the most efficient way of doing what?

You could improve the performance of the query by combining the first two commands.

index=myindex (EventCode=4663 OR EventCode=4660) OR (EventID=2 OR EventID=3 OR EventID=11) OR (Processes="*del*.exe" OR Processes="*rm*.exe" OR Processes="*rmdir*.exe") process!="C:\\Windows\\System32\\svchost.exe" process!="C:\\Program Files\\Microsoft Advanced Threat Analytics\\Gateway\\Microsoft.Tri.Gateway.exe"  process!="C:\\Program Files\\Common Files\\McAfee\\*" process!="C:\\Program Files\\McAfee*" process!="C:\\Windows\\System32\\enstart64.exe" process!="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" process!="C:\\Program Files\\Windows\\Audio\\EndPoint\\3668cba\\cc\\x64\\AudioManSrv.exe"
| table  _time, source, subject, object_file_path, SubjectUserName, process, result

Legibility can be improved a little by the IN operator.

index=myindex (EventCode=4663 OR EventCode=4660) OR (EventID=2 OR EventID=3 OR EventID=11) OR (Processes="*del*.exe" OR Processes="*rm*.exe" OR Processes="*rmdir*.exe") 
NOT process IN ("C:\\Windows\\System32\\svchost.exe" 
                "C:\\Program Files\\Microsoft Advanced Threat Analytics\\Gateway\\Microsoft.Tri.Gateway.exe" 
                "C:\\Program Files\\Common Files\\McAfee\\*" "C:\\Program Files\\McAfee*" 
                "C:\\Windows\\System32\\enstart64.exe" 
                "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 
                "C:\\Program Files\\Windows\\Audio\\EndPoint\\3668cba\\cc\\x64\\AudioManSrv.exe")
| table  _time, source, subject, object_file_path, SubjectUserName, process, result

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Not the most efficient way of doing what?

You could improve the performance of the query by combining the first two commands.

index=myindex (EventCode=4663 OR EventCode=4660) OR (EventID=2 OR EventID=3 OR EventID=11) OR (Processes="*del*.exe" OR Processes="*rm*.exe" OR Processes="*rmdir*.exe") process!="C:\\Windows\\System32\\svchost.exe" process!="C:\\Program Files\\Microsoft Advanced Threat Analytics\\Gateway\\Microsoft.Tri.Gateway.exe"  process!="C:\\Program Files\\Common Files\\McAfee\\*" process!="C:\\Program Files\\McAfee*" process!="C:\\Windows\\System32\\enstart64.exe" process!="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" process!="C:\\Program Files\\Windows\\Audio\\EndPoint\\3668cba\\cc\\x64\\AudioManSrv.exe"
| table  _time, source, subject, object_file_path, SubjectUserName, process, result

Legibility can be improved a little by the IN operator.

index=myindex (EventCode=4663 OR EventCode=4660) OR (EventID=2 OR EventID=3 OR EventID=11) OR (Processes="*del*.exe" OR Processes="*rm*.exe" OR Processes="*rmdir*.exe") 
NOT process IN ("C:\\Windows\\System32\\svchost.exe" 
                "C:\\Program Files\\Microsoft Advanced Threat Analytics\\Gateway\\Microsoft.Tri.Gateway.exe" 
                "C:\\Program Files\\Common Files\\McAfee\\*" "C:\\Program Files\\McAfee*" 
                "C:\\Windows\\System32\\enstart64.exe" 
                "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 
                "C:\\Program Files\\Windows\\Audio\\EndPoint\\3668cba\\cc\\x64\\AudioManSrv.exe")
| table  _time, source, subject, object_file_path, SubjectUserName, process, result

 

---
If this reply helps you, Karma would be appreciated.

OzzMann80
Engager

Thats Pretty much exactly what I was looking for, Thank you.

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...