Hi,
I'm getting a trouble with this situation. I have two searches:
From the first one i get host and auid:
index=unix | fields host type auid hostname
| eval mainhost=host
| search type="ANOM_LOGIN_FAILURES" OR type="USER_LOGIN" OR type="LOGIN"
| stats count as Attemps, count(eval(type="ANOM_LOGIN_FAILURES")) as Failed, count(eval(type="USER_LOGIN" OR type="LOGIN")) as Success by auid mainhost
| where Failed>0 AND Success>0
And i want to use these two fields on subsearch to get the username linked to that auid:
| appendcols maxtime=3600
[ search index="os" host=$mainhost$ sourcetype="Unix:UserAccounts" user_id=$auid$
| table user
| dedup user]
| table auid,mainhost,Attemps,Failed,Success,user
but it doesn't work. I'm not getting any information on user field but if i change the $mainhost$ and $auid$ with the value returned by the main search, it works propertly. How can i use main fields on subsearch to filter its results?
Thank you for your time.
... View more