Splunk Search

Strange Splunk Search Exclusion Results

johann2017
Explorer

Hello. I am creating a search to see when the Account_Name called "helpdesk" logs in via EventCode 4624 with Logon_Type=3. My goal is to see what source machines (src_nt_host) normally perform this logon behavior with that account name. After I find the source machines I will exclude them in the search so I can alert off of it.

A search going back the past 3 months below brings back five different source machines (src_nt_host).

Here is the strange part - when I exclude one of those five source machines using src_nt_host!=machineA then rerun the search, it brings back more source machines that never showed up in the original search! Any clue why this is occurring? It would be awesome if I could figure out what is going on!

index=*-windows-logs (EventCode=4624 AND Logon_Type=3) Account_Name=helpdesk | sort - _time | table _time, Account_Name, EventCode, Logon_Type, src_nt_host, dest_nt_host, signature

Tags (1)
0 Karma
1 Solution

TISKAR
Builder

Hello,

Can you please add the option of | sort 0 - _time command like this:

**index=-windows-logs (EventCode=4624 AND Logon_Type=3) Account_Name=helpdesk | sort 0 - _time | table _time, Account_Name, EventCode, Logon_Type, src_nt_host, dest_nt_host, signature*

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Sort

View solution in original post

0 Karma

TISKAR
Builder

Hello,

Can you please add the option of | sort 0 - _time command like this:

**index=-windows-logs (EventCode=4624 AND Logon_Type=3) Account_Name=helpdesk | sort 0 - _time | table _time, Account_Name, EventCode, Logon_Type, src_nt_host, dest_nt_host, signature*

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Sort

0 Karma

johann2017
Explorer

Hello TISKAR. I tried it but it made no difference...

0 Karma

TISKAR
Builder

Can you please run this request:

index=-windows-logs (EventCode=4624 AND Logon_Type=3) Account_Name=helpdesk | stats count

And compar result with:

index=-windows-logs (EventCode=4624 AND Logon_Type=3) Account_Name=helpdesk NOT  src_nt_host=machineA | stats count
0 Karma

johann2017
Explorer

First search (no exclusions) = 450,073

Second search (with the machineA exclusion) = 79,947

0 Karma

johann2017
Explorer

If I run these two searches, the Statistics totals are 29 and 28 - only off by one (which makes sense because I excluded only one machine). Therefore that seems to add up correctly. Not sure why my original search only showed 5 systems.

index=*-windows-logs (EventCode=4624 AND Logon_Type=3) Account_Name=administrator | table src_nt_host | dedup src_nt_host

index=*-windows-logs (EventCode=4624 AND Logon_Type=3) Account_Name=administrator src_nt_host!=machineA | table src_nt_host | dedup src_nt_host

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...