Security

Splunk Web login user IP address correlation?

gljiva
Path Finder

Hi, there seems to be no IP address form where user logged to Splunk Web in _audit index. I've tried to correlate events from _audit and _internal indexes based on timestamp, but have a problem with table creation.

index=_audit action="login attempt" info="succeeded"  | JOIN type=left date_year date_month date_mday date_hour date_minute date_second [ search index=_internal "POST /en-US/account/login HTTP/1.1"]

This search merges user and clientip fields in one event and I can see them in results, but when I try to show just two fields, or make them into table it shows just clientip or just user fields and other is empty.

index=_audit action="login attempt" info="succeeded"  | JOIN type=left date_year date_month date_mday date_hour date_minute date_second [ search index=_internal "POST /en-US/account/login HTTP/1.1"] | fields + user clientip

Or like this:

index=_audit action="login attempt" info="succeeded"  | JOIN type=left date_year date_month date_mday date_hour date_minute date_second [ search index=_internal "POST /en-US/account/login HTTP/1.1"] | table user clientip

thx

1 Solution

bojanz
Communicator

Something like this should work:

index=_audit action="login attempt" info="succeeded" | JOIN type=left date_year date_month date_mday date_hour date_minute date_second [ search index=_internal "POST /en-US/account/login HTTP/1.1" | fields date_year date_month date_mday date_hour date_minute date_second clientip] | eval newfield = if(isnull(clientip), 1, 0) | search newfield=0 | table clientip user _time

It will print a table with information you need.

View solution in original post

bojanz
Communicator

Something like this should work:

index=_audit action="login attempt" info="succeeded" | JOIN type=left date_year date_month date_mday date_hour date_minute date_second [ search index=_internal "POST /en-US/account/login HTTP/1.1" | fields date_year date_month date_mday date_hour date_minute date_second clientip] | eval newfield = if(isnull(clientip), 1, 0) | search newfield=0 | table clientip user _time

It will print a table with information you need.

gljiva
Path Finder

I have noticed some problems with this approach, apparently some logins will not be matched even if they have same time. Is there some better approach or is there some bug in the logic.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...