- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to create a search in which the following should be done:
- look for a user creation process (ID 4720)
- and then look (for the same user) if there is a follow up group adding event (4728) for privileged groups like (512,516 etc.)
my SPL was so far like that:
index=lalala source=lalala EventID=4720 OR 4728 PrimaryGroupId IN (512,516,517,518,519)
BUT that way I only look for either a user creation OR a user being added as a privileged user. but I want to like both. I understand that I need to somehow connect those two searches but I don't know how exactly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi
I think that this is place for sub query like
index=lalala source=lalala EventID=4728 AND PrimaryGroupId IN (512,516,517,518,519) AND
[ search index=lalala source=lalala EventID=4720
| fields UserName | dedup UserName | format ]
In this way it first look those UserNames which has created and then that "outer" base search this those (UserName = "xxx" OR UserName = "yy"....)
If you are looking for long period then maybe there is better options too.
r. Ismo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi
I think that this is place for sub query like
index=lalala source=lalala EventID=4728 AND PrimaryGroupId IN (512,516,517,518,519) AND
[ search index=lalala source=lalala EventID=4720
| fields UserName | dedup UserName | format ]
In this way it first look those UserNames which has created and then that "outer" base search this those (UserName = "xxx" OR UserName = "yy"....)
If you are looking for long period then maybe there is better options too.
r. Ismo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks a lot, that was the solution !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello hello!
I think what you are looking for here is the `transaction` command, but it can have some extra over-head. I'll leave some examples here to see if they work for you. Since your requirement is simple, I suggest using the `stats` command instead of `transaction`. If you wanted to look at a specific EventID first and then another specific EventID after, `transaction` might be easier to implement.
Version using `transaction`:
index=lalala source=lalala (EventID=4720 OR (EventID=4728 AND PrimaryGroupId IN (512,516,517,518,519)))
| transaction UserName maxspan=5m
| search EventID=4720 AND EventID=4728
Version using `stats`:
index=lalala source=lalala (EventID=4720 OR (EventID=4728 AND PrimaryGroupId IN (512,516,517,518,519)))
| stats values(EventID) AS EventIDs by UserName
| search EventIDs=4720 EventIDs=4728
Edit: Fixing the code blocks.
