Hello, This probably a stu*** question, but I am not able to find a clear answer. My code to generate the lookup table works. Here are the contents of my lookup table. Input field acct Ex: user1 Output fields aid and adr Exs: 1111 and 10.10.10.10 Input field is selected from a drop down in dashboard panel. Need to search for events containing any combination of acct, aid and/or adr. My code results in the same events containing all 3 of these fields. Here is my code. index="linuxevents" AND host=ru.us AND source="/var/log/audit/audit.log" AND earliest="09/23/2019:14:28:00" AND latest="09/23/2019:14:30:00" `comment(" AND (acct="user1" OR auid=aid OR addr=adr) ")` | lookup myAAAlookup.csv acct | where (acct="user1") OR (auid=aid) OR (addr=adr) | table _time, event_id, host, acct, auid, aid, addr, adr, _raw Note: If I comment out the where command and uncomment the matching terms AND, the same events are generated containing ALL 3 fields. Isn't there a simple way to do this? Thanks in advance and God bless, Genesius ... View more

Hello, My colleague and I noticed an issue in the following SPL. If there is data, the SPL works. If there isn't any events, this error message comes up. How can this situation be handled cleanly? "Error in 'search' command: Unable to parse the search: Invalid search: OR OR." `comment("THIS WORKS. 912 events new code. ~2:15 mins")` index="linuxevents" AND earliest=-24h@h AND latest=@h AND host=server1 AND (source="/var/log/sudo.log" OR source="/var/log/secure" OR source="/var/log/audit/audit.log") `comment("70 events -- audit.log -- acct or auid -- overlap with first 'OR subsearch'")` AND [ search index="linuxevents" AND earliest=-24h@h AND latest=@h AND host=server1 AND source="/var/log/audit/audit.log" AND (acct="user1" OR auid="1014")] `comment("46 events -- audit.log -- ip address")` OR [ search index="linuxevents" AND earliest=-24h@h AND latest=@h AND host=server1 AND source="/var/log/audit/audit.log" AND acct="user1" AND (auid!="0" AND auid!="4294967295") AND addr!="?" | head limit=1 | eval addr="\"".addr."\"" | return $addr ] `comment("2 events -- audit.log -- new auid")` OR [ search index="linuxevents" AND earliest=-24h@h AND latest=@h AND host=server1 AND source="/var/log/audit/audit.log" AND (_raw="*new auid*" AND "1014") ] | dedup _raw | transaction event_id `comment("7 events -- secure -- user or ip address.")` | append [ search index="linuxevents" AND earliest=-24h@h AND latest=@h AND (source="/var/log/sudo.log" OR source="/var/log/secure") AND host=server1 | rex field=_raw "for\suser\s(?<userId>[\w\-]*)" | rex field=_raw "publickey\sfor\s(?<userId>[\w\-]*)" | rex field=_raw "\sfrom\s(?<ipAddr>(?:\d{1,3}\.){3}\d{1,3})|\sfrom\s(?<pcName>[0-9a-zA-z\.\-]*)" | where userId="user1" OR ipAddr="10.10.10.10" ] | eval log=case(source=="/var/log/sudo.log", "sudo", source=="/var/log/secure", "secure", source=="/var/log/audit/audit.log", "audit") | sort +_time | table _time, log, host, addr, ipAddr, auid, acct, userId, pcName, ses, pid, _raw Thanks and God bless, Genesius ... View more

Hello, Still learning and getting better at it. However, I have this very complex search in one of my dashboard panels, and I would like to optimize it. I am reviewing the links @niketn offered to another Splunker in this post (https://answers.splunk.com/answers/620388/how-to-make-efficient-and-fast-searches-reports-an.html) and I figure I would post my code for additional feedback and insights. Initially, I was looking for a way to use post-processing. But unless I am mistaken, that would work between panels; and not within the same panel, because only one per panel. Correct? I was also thinking of running a main search in a hidden panel where depends equals something that will never happen; therefore keeping the panel hidden. In this panel I would use the and then in the main (visible) panel use . Is this viable? Here is my complex search. Note: the tokens are selected via dropdown inputs in the dashboard. $Selected_Time_Range.earliest$ $Selected_Time_Range.latest$ $hostName_tok$ $userId_tok$ $linuxId_tok <search> <query> [ search index="*linuxevents" AND earliest=$Selected_Time_Range.earliest$ AND latest=$Selected_Time_Range.latest$ AND (source="/var/log/sudo.log" OR source="/var/log/secure") AND host=$hostName_tok$ AND _raw="*$userId_tok$*" | append [ search index="*linuxevents" AND earliest=$Selected_Time_Range.earliest$ AND latest=$Selected_Time_Range.latest$ AND (source="/var/log/sudo.log" OR source="/var/log/secure") AND host=$hostName_tok$ AND [ search index="*linuxevents" AND source="ps" AND earliest=$Selected_Time_Range.earliest$ AND latest=$Selected_Time_Range.latest$ AND host=$hostName_tok$ AND (USER=$userId_tok$ OR (USER="root" AND "*$userId_tok$*")) | dedup pid | sort +pid | table pid ] ] | dedup _raw ] | append [ search index="*linuxevents" AND earliest=$Selected_Time_Range.earliest$ AND latest=$Selected_Time_Range.latest$ AND source="/var/log/audit/audit.log" AND host=$hostName_tok$ AND [ search index="*linuxevents" AND earliest=$Selected_Time_Range.earliest$ AND latest=$Selected_Time_Range.latest$ AND source="/var/log/audit/audit.log" AND host=$hostName_tok$ AND ([`multi_field_search("auid euid fsuid id inode_uid oauid ouid sauid suid uid", "$linuxId_tok$")`] OR [`multi_field_search("user acct cwd name", "*$userId_tok$*")`]) | dedup event_id | sort +event_id | table event_id ] | append [search index="*linuxevents" AND earliest=$Selected_Time_Range.earliest$ AND latest=$Selected_Time_Range.latest$ AND source="/var/log/audit/audit.log" AND host=$hostName_tok$ AND ([`multi_field_search("user acct cwd name", "*$userId_tok$*")`] OR [`multi_field_search("auid euid fsuid id inode_uid oauid ouid sauid suid uid", "$linuxId_tok$")`] OR [ search index="*linuxevents" AND earliest=$Selected_Time_Range.earliest$ AND latest=$Selected_Time_Range.latest$ AND source="/var/log/audit/audit.log" AND host=$hostName_tok$ AND [`multi_field_search("user acct cwd name", "*$userId_tok$*")`] AND (auid!="0" AND auid!="4294967295") AND addr!="?" | head limit=1 | eval addr="\"".addr."\"" | return $addr ]) ] | append [ search index="*linuxevents" AND earliest=$Selected_Time_Range.earliest$ AND latest=$Selected_Time_Range.latest$ AND source="/var/log/audit/audit.log" AND host=$hostName_tok$ AND (_raw="*new auid*" AND "$linuxId_tok$") ] | dedup _raw | transaction event_id ] | eval log=case(source=="/var/log/sudo.log", "sudo", source=="/var/log/secure", "secure", source=="/var/log/audit/audit.log", "audit") | sort +_time | table _time, log, host, _raw </query> </search> Thanks for direction and ideas in advance. God bless, Genesius PS I am overthinking this? Is the answer that obvious? ... View more