Splunk Search

System login after hours

essibong1
New Member

Hello,
I had requested help with a "search language that could determine system logins after core hours" and one of the nice people here puts the below search together for me. does this search need any revisions or is it incomplete? if it does need some revisions can anyone help with such revisions please?

[out_working_time]
definition = | eval day=strftime(_time,"%d/%m/%Y")\
| lookup SIEMCAL.csv day OUTPUT type\
| search Tipo=2 OR (Tipo=1 (date_hour>14 OR (date_hour<7 AND date_minute<45))) OR (Tipo=0 (date_hour>20 OR (date_hour<8 AND date_minute<45)))
iseval = 0

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @essibong1,
sorry, probably I wasn't so clear in my previous answer!

this is a macro definition that I hinted in my answer to your previous question ( https://answers.splunk.com/answers/789359/can-any-one-provide-me-with-a-good-search-to-monit.html#an... 😞 I used a macro to have in only one point the working time definition so I can modify it in only one point instead in each search of my app.

Anyway, if you don't want to use a macro, you have to create your search starting from the filter for the access events (e.g. in windows EventCode=4624) and then filter for the hours and minutes.

The other needed information is if you want only to filter for time or you want also to filter for holydays:

if you want to filter only for time, you can run something like this (working time 8.00 - 17.00):

index=your_index EventCode=4624 (date_hour<8 OR date_hour>18)
| ...

If instead you want also holydays (using the lookup), you have to create a lookup (called e.g. SIEMCAL.csv) containing two information:

  • day in a format you like (e.g. dd/mm/yyyy),
  • type (0 for working time, 1 for half working time, 2 for holydays).

So for windows systems you can run something like this:

index=your_index EventCode=4624 
| eval day=strftime(_time,"%d/%m/%Y")
| lookup SIEMCAL.csv day OUTPUT type
| search type=2 OR (Tipo=1 (date_hour>14 OR (date_hour<8)) OR (type=0 (date_hour>18 OR date_hour<8)))
| ...

Ciao.
Giuseppe

0 Karma

FrankVl
Ultra Champion

That's not a search, it is a macro.

Maybe easier to just continue in the original question: https://answers.splunk.com/answers/789359/can-any-one-provide-me-with-a-good-search-to-monit.html

As I mentioned there, there are some serious caveats with that macro, so I'd not recommend using it like that. Especially if you apparently don't understand what it does.

There were some good comments and questions on your previous post. I'd start with looking at those and responding to the clarification questions that were asked there. Otherwise it is not really possible to provide a lot of help.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That doesn't look like a search. It looks like a macro definition.
Your best option is to ask the person who gave you the information.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...