Splunk Search

comparing values returned by two separate searches

Justin_Grant
Contributor

I have two searches. One search returns a field (using stats count) representing the number of users logging into a website. The other search returns a field (also using stats count) representing the number of users who have tried to reset their password. If there are more password resets than normal logins, this usually indicates an attacker is trying to mine data from our password-reset function.

What I'd like is a search with a field representing the ratio of the two other counts.

Any idea how to do this efficiently?

sideview
SplunkTrust
SplunkTrust

The best way to do this is to use a disjunction and do it in a single search.

say that right now you have:

<login search> | stats count

<password reset search> | stats count

It somewhat depends on how complex the searches are but if they are literally just searches and they arent using other search commands, you can just do:

(<login search>) OR (<password reset search>)
| eval isLogin=if(searchmatch(<login search>),1,0) 
| eval isPasswordReset=if(searchmatch(<password reset search>),1,0) 
| stats sum(isLogin) as totalLogins sum(isPasswordReset) as totalPasswordResets

if you know that an event will never be both, then you could save some time by just doing totalPasswordResets = count-totalLogins, but you get the idea.

Its very common to approach these problems thinking about subsearches and thinking about the join and append commands, but often the best answer is just to use stats and eval. Here's another one: http://answers.splunk.com/questions/822/simulating-a-sql-join-in-splunk/1717#1717

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...