Splunk Search

Splunk query - multiple values from a field

verifi81
Path Finder

Hi everyone. I'm trying to get this query going  with one search but I can't seem to do that. I can only get it to work when I separate into two queries. Here are the two queries.  

Query1:

index=wineventlog NewObjectDN="*OU=blue*" OldObjectDN=*"Rad Users"* signature_id=4147

 

Query2:

index=wineventlog NewObjectDN="*OU=blue*" OldObjectDN=*"Fad Users"* signature_id=4147

 

the Field OldObjectDN has multiple values I'm trying to combine into one search. What would the proper syntax be?

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=wineventlog NewObjectDN="*OU=blue*" (OldObjectDN=*"Rad Users"* OR OldObjectDN=*"Fad Users"*) AND NOT (OldObjectDN=*"Rad Users"* AND OldObjectDN=*"Fad Users"*) signature_id=4147

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=wineventlog NewObjectDN="*OU=blue*" (OldObjectDN=*"Rad Users"* OR OldObjectDN=*"Fad Users"*) AND NOT (OldObjectDN=*"Rad Users"* AND OldObjectDN=*"Fad Users"*) signature_id=4147
0 Karma

verifi81
Path Finder

HI Soutamo, If I use your suggestion I get other values of the oldobjectDN that don't match "Rad Users" or "Fad Users". 

I want the search result to ONLY give me events when the OldObjectDN contains either of those two values.

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

If I understand right, you want to implement XOR not OR operation?

As Splunk haven't XOR on SPL (SPL2 have it?) you must write it with NOT AND. In your case it should work like

index=wineventlog NewObjectDN="*OU=blue*" NOT (OldObjectDN=*"Rad Users"* AND OldObjectDN=*"Fad Users"*) signature_id=4147

r. Ismo 

0 Karma

verifi81
Path Finder

Because the value "Sad Users" is being returned as well.

Trying to only return these values:

Rad Users
Fad Users

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Logical OR if the intention is to include both "Rad Users" and "Fad Users" in output.

index=wineventlog NewObjectDN="*OU=blue*" (OldObjectDN=*"Rad Users"* OR OldObjectDN=*"Fad Users"*) signature_id=4147

 

0 Karma

verifi81
Path Finder

Yuanliu,

I'm trying to include either values but not both values.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Can you illustrate input data and how the desired output will look like?

0 Karma

verifi81
Path Finder

Sure. Suppose I have this:

Field:
OldObjectDN

Possible values:
OU=Rad Users
OU=Fad Users
OU=Sad Users
OU=Bad Users
OU=Mad Users

I only want the search to return events only if OldobjectDN has the values for Rad User OR Fad Users

 

 

0 Karma

verifi81
Path Finder

I got it. 
I had to do it this way

 

(OldObjectDN=*"OU=Rad Users"*) OR (OldObjectDN=*"OU=Fad Users"*)

 

I appreciate the help from both of you.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You should try 

index=wineventlog NewObjectDN="*OU=blue*" OldObjectDN IN (*"Rad Users"*, *"Fad Users"*) signature_id=4147

 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...