So I have the following search:
search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"| table src_ip
which generates a list of IPs for which I need to search for username's against.
Normally, for a single IP (e.g. 192.168.0.1) I can run:
sourcetype=WinEventLog* 192.168.0.1 "EventCode=4624" | table src_ip, user|dedup src_ip, user
and I get a list of users that have logged into that system.
How do I use the results of the IP list from my first search to generate a table with IPs and usernames? I've been trying subsearches but to-date I've been unsuccessful.
Thank you in advance for the help.
You really need to know the field name for the IP in the second search. The single field output from the first search needs to match that. Assuming you have a field named src_ip in the second set of logs:
[ search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"
| table src_ip
] sourcetype=WinEventLog* "EventCode=4624"
| table src_ip, user
| dedup src_ip, user
This will essentially create a list of (src_ip=something OR src_ip=somethingelse ....)
representing all your src_ips and insert that into your search string.
Can you try this below:
sourcetype=WinEventLog* "EventCode=4624" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"
[ search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"| dedup src_ip| table src_ip ]
| table src_ip, user
|dedup src_ip, user
try this:
sourcetype=WinEventLog* "EventCode=4624" [search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"| table src_ip|format]| stats count by src_ip, user|fields - count