Hi,
I'm trying to correlate events from 2 different sourcetypes. The “correlation field” is the user email address.
We have the email address under ‘user’ field in the ‘Logs‘ sourcetype but we do not have it in ‘Session’ Logs.
To retrieve the user email from Session Logs, I use a lookup table.
I’ve built the following search :
(sourcetype=Session) OR (sourcetype=Logs AUTH_Status=AUTHN_METHOD_SUCCESS) | lookup UserList sAMAccountName as AccountName OUTPUT userPrincipalName as user | transaction user, startswith="AUTHN_METHOD_SUCCESS" endswith=",Online," maxspan=10m | table user, duration, _time, sourcetype
It seems that the transaction is not done on the field ‘user’ (I can see that in the results).
Does the transaction command support data that comes from a lookup table?
Maybe I miss something else?
Thanks for your help
Assuming the Session sourcetype does not have field sAMAccountName
then the lookup command will not find a match and may be replacing the user
field with null. Replacing OUTPUT
with OUTPUTNEW
may help.
Another approach would be a join:
(sourcetype=Session) | join user [sourcetype=Logs AUTH_Status=AUTHN_METHOD_SUCCESS) | lookup UserList sAMAccountName as AccountName OUTPUT userPrincipalName as user] | ...