Transaction Startswith Endswith Not Grabbing Events Even Though Individual Searches Find Events

[BigBoss__]

Hello,

I'm trying to create a search that grabs an authentication failure event followed by a an authentication success event from the same src. My current search looks like this:

index=wineventlog sourcetype=wineventlog source=wineventlog:security EventCode=4625 src=host1
| stats values(dest) as dest by _time, src
| eval event_id=start
| search
[| search index=wineventlog sourcetype=wineventlog source=wineventlog:security EventCode=4624 src=host1
| stats values(dest) as dest by _time, src
| eval event_id=finish]
| transaction src startswith=event_id=start endswith=event_id=finish maxspan=2m
| stats values(dest) as dest by _time, src

Each individual search runs fine on it's own and finds events for host 1, and comparing the results of each search, I can see that the events occur within 2 minutes of each other. 

However my transaction search fails to grab both events. Instead it only grabs the events from the first search, and fails to grab the events from the sub search. Am I missing something?

[scelikok]

Great news 🙂

You can adapt the same method like below, I assume you want to get dest field again. The point with different sources/indexes you may need to map required fields to same field name.

(index=network sourcetype=firewall action=failed src=host1) OR
(index=wineventlog sourcetype=wineventlog source=wineventlog:security EventCode=4625 src=host1)
| transaction src startswith=action="failed" endswith=EventCode="4624" maxspan=2m
| stats values(dest) as dest by _time, src

[scelikok · Accepted solution]

Hi @BigBoss__,

Please try below, you don't need subsearch,

index=wineventlog sourcetype=wineventlog source=wineventlog:security (EventCode=4625 OR EventCode=4624) src=host1
| transaction src startswith=EventCode="4625" endswith=EventCode="4624" maxspan=2m
| stats values(dest) as dest by _time, src

[BigBoss__]

Thank you @scelikok ! This worked.

Follow-up question, this solution worked since the events were both from the same index and sourcetype. How would you have structured the search if the two searches were for completely different indexes and sourcetypes?

For example:

index=network sourcetype=firewall action=failed src=host1

index=wineventlog sourcetype=wineventlog source=wineventlog:security EventCode=4625 src=host1