Hi Splunkers, I need your help on the following data set. Index=auditbeat host --> log source command --> command run by host _time --> _time host1: _time : 00.00:00 - 00.15:00 --> 15 min inte...
See more...
Hi Splunkers, I need your help on the following data set. Index=auditbeat host --> log source command --> command run by host _time --> _time host1: _time : 00.00:00 - 00.15:00 --> 15 min interval commands run by host1 in time interval above (15 min) : ls, tar, sudo, whoami, cd, mkdir host2: _time : 00.00:00 - 00.15:00 --> 15 min interval commands run by host2 in time interval above (15 min) : ls, rm, history, whoami, cd, mkdir host3: _time : 00.00:00 - 00.15:00 --> 15 min interval commands run by host3 in time interval above (15 min) : ls, chown, chroot, whoami, cd, mkdir I need to write a search which will look at each 15 min time interval, within EACH15 min time interval if any machine (host) run all these command 'whoami','chroot' and 'history', search will list the result as following time interval -- host -- commands Thanks for your help.