Splunk Enterprise

How to split up a search in a data model

pitassi17
New Member

I'm trying to take a search and put it into a data model. I really don't understand the documentation online about using root events and transaction events and the other stuff. I've done simple constraints with just one root event and that has been fine. I'm pretty sure I need to start with a root event but, since you can't put pipes in the constraints, I'm having a difficult time getting this search into the model. Here is the search:

(EventCode=4624 OR EventCode=4625) AND Logon_Type=3 Authentication_Package=NTLM NOT Account_Name="ANONYMOUS LOGON" AND Account_Domain="CHI" [ search EventCode=8001 NOT Domain_name_of_user="CHI" | where _time > relative_time(_time,"-5s") | eval Workstation_Name = host | fields + Workstation_Name ]

Any help with this is greatly appreciated!

Tags (2)
0 Karma
1 Solution

rjthibod
Champion

You cannot have sub-searches in the constraint of a search in a datamodel.

You can only put in the first part

(EventCode=4624 OR EventCode=4625) AND Logon_Type=3 Authentication_Package=NTLM NOT Account_Name="ANONYMOUS LOGON" AND Account_Domain="CHI"

You should also restrict your search to specific index(es) or sourcetype(s) of some kind.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Didn't get your subsearch-where clause. Won't _time > relative_time(_time,"-5s") always be true?? Or you want to check the _time of base search with subsearch, and that's not possible.

0 Karma

pitassi17
New Member

I'm new to this so I wouldn't be surprised if that doesn't do what I think. I'm more interested in the data model aspect of the question. If it helps, pretend the where clause isn't there.

0 Karma

rjthibod
Champion

You cannot have sub-searches in the constraint of a search in a datamodel.

You can only put in the first part

(EventCode=4624 OR EventCode=4625) AND Logon_Type=3 Authentication_Package=NTLM NOT Account_Name="ANONYMOUS LOGON" AND Account_Domain="CHI"

You should also restrict your search to specific index(es) or sourcetype(s) of some kind.

0 Karma

pitassi17
New Member

So there is no way for me to add a field from a subsearch into my main search in data models? So I can only use a child to narrow down my results more?

0 Karma

rjthibod
Champion

Not in the search constraint. You can try adding it via a lookup field, but that would require you populating a lookup table with the Workstation_Name field via a savedsearch. That may be potentially risky if the Workstation_Name field value is very time sensitive relative to your first search. Risky being that your datamodel may not be accurate if the savedsearch to populate the lookup does not run reliably.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...