Splunk Search

Why is my search returning "Error in 'eval' command: The expression is malformed. Expected XOR"?

Federica_92
Communicator

Hi everyone,

I have this search:

index=main sourcetype=WinEventLog:Security 
| eval Logon_failur = case((EventCode==4625 AND (Status==0xC0000234 OR Status==0xC0000072 OR Status==0xC0000193 OR Sub_Status==0xC0000234 OR Sub_Status==0xC0000072 OR Sub_Status==0xC0000193)), "FailedToLogOn", EventCode==531, "AccountDisabled", EventCode==532, "UserAccountExpired", EventCode==539, "AccountLockOut" ) 
| bin _time span=1h
| stats count by Logon_failur 
| where count>50

But I get this error:

 Error in 'eval' command: The expression is malformed. Expected XOR. 

The problem is that I cannot use XOR, because it is not what I'm trying to do. I need the first value and one of the succeeding values, and if both of them match, I will have "true".
How can I do this?
And second question, in your opinion, is the second part of the search starting from "bin" correct?

Thank you

Tags (2)
0 Karma
1 Solution

fdi01
Motivator

try like this:

...| eval Logon_failur = case((EventCode=="4625" AND (Status=="0xC0000234" OR Status=="0xC0000072" OR Status=="0xC0000193" OR Sub_Status=="0xC0000234" OR Sub_Status=="0xC0000072" OR Sub_Status=="0xC0000193")), "FailedToLogOn", EventCode=="531", "AccountDisabled", EventCode=="532", "UserAccountExpired", EventCode==539, "AccountLockOut" )|...

View solution in original post

fdi01
Motivator

try like this:

...| eval Logon_failur = case((EventCode=="4625" AND (Status=="0xC0000234" OR Status=="0xC0000072" OR Status=="0xC0000193" OR Sub_Status=="0xC0000234" OR Sub_Status=="0xC0000072" OR Sub_Status=="0xC0000193")), "FailedToLogOn", EventCode=="531", "AccountDisabled", EventCode=="532", "UserAccountExpired", EventCode==539, "AccountLockOut" )|...

chimell
Motivator

Hi
Make sure that you don't have a line in your search that begin with OR.

0 Karma

Runals
Motivator

Have you tried wrapping the values in your eval in quotes by chance?

Federica_92
Communicator

No, can you show me a brief example of what you mean?

0 Karma

Federica_92
Communicator

Uh yes, it' working like this:
index=main sourcetype=WinEventLog:Security | eval Logon_failur = case((EventCode=="4625" AND (Status=="0xC0000234" OR Status=="0xC0000072" OR Status=="0xC0000193" OR Sub_Status=="0xC0000234" OR Sub_Status=="0xC0000072" OR Sub_Status=="0xC0000193")), "FailedToLogOn", EventCode=="531", "AccountDisabled", EventCode=="532", "UserAccountExpired", EventCode==539, "AccountLockOut" ) | bin _time span=1h | stats count by Logon_failur | where count>50

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...