Splunk content

[quangnm21]

This was my initial search. I cannot compare the two fields "srcdomain = destdomain" because when I intend to use eval my value is output as null. Thanks everyone

[gcusello · Accepted solution]

Hi @quangnm21 ,

after every stats command (also tstats) you have only the fields that are present in the command, so dest_nt_domain and src_nt_domain aren't still present.

You have to insert in the tstats command the two fields with the values option:

| tstats `security.content.summariesonly` 
   values(host) AS srcHost 
   dc(host) AS chost 
   min(_time) AS firstTime 
   max(_time) AS lastTime 
   values(Authentication.dest_nt_domain) AS dest_nt_domain
   values(Authentication.src_nt_domain) AS src_nt_domain 
   FROM datamodel=Authentication 
   WHERE Authentication.action="success" Authentication.dest_nt_domain="PTIT" Authentication.src_nt_domain="PTIT" Authentication.user="qmn"
   BY Authentication.user
| eval 
   abc = tostring(dest_nt_domain),
   xyz = tostring(src_nt_domain)

 Then I hint to rename some fields avoiding the dot in the name (sometimes functions don't work).

Last doubt: if you have the Authentication.user field in the WHERE condition, why do you have it also in the BY cluse? it's always one value!

Last thing: please next time use, in addition to the screenshots, add also the search in text mode (using the "Insert/Edit code sample" button) , so I don't need to rewrite it!

Ciao.

Giuseppe

[quangnm21]

@gcusello , Thank you

[gcusello]

Hi @quangnm21 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉