Splunk Search

what is the best way to enrich events from another search?

pwild_splunk
Splunk Employee
Splunk Employee

I have two data sources

Source A
time action src_ip session user
- "action" varies between (logon, logoff and relogon)
- "session" contains a randomly generated sessionID that is unique and does not appear to be reused
- "user" is the userid

Source B
time session

What is the most efficient way of enriching the event data in Source B with the user that matches the session from source A?

To give you an idea of the data-set size.

source="Source A" | stats values(user) as user by session
returns 17,000 odd unique tuples from around a million events and the job completes in under a second.

Source B contains over 100 million events.

Was thinking of running a regularly scheduled search to maintain a csv of user,session and then setting up a calculated field that performs a lookup (with the expectation that the newest events will not be enriched with a user.

Suggestions anyone?

woodcock
Esteemed Legend

When we are trying to do something like match an IP that gets recycled with the users/session/mac that obtained it, we take the obtaining/identifying dataset and use a Scheduled Search to create/trim/updated a time-based lookup and the use that lookup (which can be setup to be an Automatic Lookup) to enrich the other dataset:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Defineatime-basedlookupinSplunkWeb

0 Karma

solarboyz1
Builder

Something like:

index=sourceA OR index=SourceB
| stats min(_time) as start, max(_time) as end, values(action) as action, values(user) by user, values(scr_ip) as src_ip by session

You could also use something like a left join, however, join uses the same limits as subsearch and 10K

index=SourceB
| join type=left  session [ index=sourceA | fields user, action ]

Would need more specifics

0 Karma

adonio
Ultra Champion

what is the problem you are trying to solve? how does "Source B" data looks like? what fields or values are a match to source A?

0 Karma

pwild_splunk
Splunk Employee
Splunk Employee

I'm not wanting to build a dashboard, I wish to enrich the event data so that an investigator can search for a user and find the events associated with that user. The events in Source-B do not include a user field within the data, just a session.
Source-A will map a session to a user when the user logs on.

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...