Splunk Search

building search query

dilenthakuri
Explorer

Hi Guys,

I am just wondering if anyone can put me in the right direction - I have a question about search queries in Splunk. For example, in the below 2 simple query:

A. sourcetype="WinEventLog" EventCode=4688 New_Process_Name="*powershell.exe" | stats count by New_Process_Name, Process_Command_Line

B. sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational” EventID=1 Image=”*powershell.exe” | stats count by Image, CommandLine

How do I know the following fields exists in that particular log?

1. New_Process_Name

2. Process_Command_Line

3. Image

etc.

Thanks guys!!

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The base query (outside of a dashboard) is the part before the first pipe.

One does not need to memorize available fields, although that often comes from repeated use.  Instead, do your query building in Verbose Mode and consult the "Interesting fields" area to see what is available.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You know the New_Process_Name and Image fields exist because otherwise you will get no results from the base searches.  If Process_Command_Line does not exist then stats will return no results.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dilenthakuri
Explorer

Thanks @richgalloway !

So "Base Searches" you mean just run the below query first 

sourcetype="WinEventLog" EventCode=4688

And then, look for the field that can be appended to the search query further? Otherwise, it's not possible to remember or memorise ALL the field values while building the query. I see multiple of like below parameters set in the query:

  • Process_Command_Line
  • CommandLine
  • ParentCommandLine
  • Image
  • ParentImage
  • TargetFilename
  • User

Or, we just have to know all of these by heart? What's the method you guys use to build complex queries? 

Thank you.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The base query (outside of a dashboard) is the part before the first pipe.

One does not need to memorize available fields, although that often comes from repeated use.  Instead, do your query building in Verbose Mode and consult the "Interesting fields" area to see what is available.

---
If this reply helps you, Karma would be appreciated.

dilenthakuri
Explorer

Thank you @richgalloway What do you mean by 'Outside of the Dashboard'? Sorry

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In a dashboard, the term "base search" has a different meaning.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...