Splunk Search

Transaction Startswith Endswith Not Grabbing Events Even Though Individual Searches Find Events

BigBoss__
Engager

Hello,

I'm trying to create a search that grabs an authentication failure event followed by a an authentication success event from the same src. My current search looks like this:

index=wineventlog sourcetype=wineventlog source=wineventlog:security EventCode=4625 src=host1
| stats values(dest) as dest by _time, src
| eval event_id=start
| search
[| search index=wineventlog sourcetype=wineventlog source=wineventlog:security EventCode=4624 src=host1
| stats values(dest) as dest by _time, src
| eval event_id=finish]
| transaction src startswith=event_id=start endswith=event_id=finish maxspan=2m
| stats values(dest) as dest by _time, src

 

Each individual search runs fine on it's own and finds events for host 1, and comparing the results of each search, I can see that the events occur within 2 minutes of each other. 

However my transaction search fails to grab both events. Instead it only grabs the events from the first search, and fails to grab the events from the sub search. Am I missing something?

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @BigBoss__,

Please try below, you don't need subsearch,

index=wineventlog sourcetype=wineventlog source=wineventlog:security (EventCode=4625 OR EventCode=4624) src=host1
| transaction src startswith=EventCode="4625" endswith=EventCode="4624" maxspan=2m
| stats values(dest) as dest by _time, src
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Great news 🙂

You can adapt the same method like below, I assume you want to get dest field again. The point with different sources/indexes you may need to map required fields to same field name.

(index=network sourcetype=firewall action=failed src=host1) OR
(index=wineventlog sourcetype=wineventlog source=wineventlog:security EventCode=4625 src=host1)
| transaction src startswith=action="failed" endswith=EventCode="4624" maxspan=2m
| stats values(dest) as dest by _time, src
If this reply helps you an upvote and "Accept as Solution" is appreciated.

scelikok
SplunkTrust
SplunkTrust

Hi @BigBoss__,

Please try below, you don't need subsearch,

index=wineventlog sourcetype=wineventlog source=wineventlog:security (EventCode=4625 OR EventCode=4624) src=host1
| transaction src startswith=EventCode="4625" endswith=EventCode="4624" maxspan=2m
| stats values(dest) as dest by _time, src
If this reply helps you an upvote and "Accept as Solution" is appreciated.

BigBoss__
Engager

Thank you @scelikok ! This worked.

Follow-up question, this solution worked since the events were both from the same index and sourcetype. How would you have structured the search if the two searches were for completely different indexes and sourcetypes?

 

For example:

index=network sourcetype=firewall action=failed src=host1

index=wineventlog sourcetype=wineventlog source=wineventlog:security EventCode=4625 src=host1

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...