Splunk Search

Why is my search returning "Error in 'eval' command: The expression is malformed. Expected XOR"?

Federica_92
Communicator

Hi everyone,

I have this search:

index=main sourcetype=WinEventLog:Security 
| eval Logon_failur = case((EventCode==4625 AND (Status==0xC0000234 OR Status==0xC0000072 OR Status==0xC0000193 OR Sub_Status==0xC0000234 OR Sub_Status==0xC0000072 OR Sub_Status==0xC0000193)), "FailedToLogOn", EventCode==531, "AccountDisabled", EventCode==532, "UserAccountExpired", EventCode==539, "AccountLockOut" ) 
| bin _time span=1h
| stats count by Logon_failur 
| where count>50

But I get this error:

 Error in 'eval' command: The expression is malformed. Expected XOR. 

The problem is that I cannot use XOR, because it is not what I'm trying to do. I need the first value and one of the succeeding values, and if both of them match, I will have "true".
How can I do this?
And second question, in your opinion, is the second part of the search starting from "bin" correct?

Thank you

Tags (2)
0 Karma
1 Solution

fdi01
Motivator

try like this:

...| eval Logon_failur = case((EventCode=="4625" AND (Status=="0xC0000234" OR Status=="0xC0000072" OR Status=="0xC0000193" OR Sub_Status=="0xC0000234" OR Sub_Status=="0xC0000072" OR Sub_Status=="0xC0000193")), "FailedToLogOn", EventCode=="531", "AccountDisabled", EventCode=="532", "UserAccountExpired", EventCode==539, "AccountLockOut" )|...

View solution in original post

fdi01
Motivator

try like this:

...| eval Logon_failur = case((EventCode=="4625" AND (Status=="0xC0000234" OR Status=="0xC0000072" OR Status=="0xC0000193" OR Sub_Status=="0xC0000234" OR Sub_Status=="0xC0000072" OR Sub_Status=="0xC0000193")), "FailedToLogOn", EventCode=="531", "AccountDisabled", EventCode=="532", "UserAccountExpired", EventCode==539, "AccountLockOut" )|...

chimell
Motivator

Hi
Make sure that you don't have a line in your search that begin with OR.

0 Karma

Runals
Motivator

Have you tried wrapping the values in your eval in quotes by chance?

Federica_92
Communicator

No, can you show me a brief example of what you mean?

0 Karma

Federica_92
Communicator

Uh yes, it' working like this:
index=main sourcetype=WinEventLog:Security | eval Logon_failur = case((EventCode=="4625" AND (Status=="0xC0000234" OR Status=="0xC0000072" OR Status=="0xC0000193" OR Sub_Status=="0xC0000234" OR Sub_Status=="0xC0000072" OR Sub_Status=="0xC0000193")), "FailedToLogOn", EventCode=="531", "AccountDisabled", EventCode=="532", "UserAccountExpired", EventCode==539, "AccountLockOut" ) | bin _time span=1h | stats count by Logon_failur | where count>50

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...