Help with subsearches

Question

We are required to produce monthly audits of access to files that are covered by SOX. There are 8 groups of folders that we have to audit. Originally we were doing one search per folder and outputting the results to a csv file. I'd like to run a single search for the all of the file audit events and then use subsearches to output particular files to csv.

I've tried something like the search below and it gives me an error that subsearches can only be used as part of a command. What am I doing wrong?

host=jamba EventCode="560" Client_Domain="JUICE" Object_Name!="*.tmp" Object_Name="*\\*.*" Client_User_Name!="*$" Client_User_Name!="!*" | stats count(TimeWritten) as TimesAccessed by Object_Name Client_User_Name Accesses | [search "Folder1\\Folder2" | outputcsv AuditGroup1.csv] [search "Folder3\\Folder4 | outputcsv AuditGroup2.csv]

Thanks!

Answer 1

If the goal here is to produce several different CSV files, each containing some subset of the whole report, subsearches will not help you achieve that. Subsearches are mainly used for two purposes:

Parametrize one search using the output of another search (for example, find me every record from IP addresses that visited some specific URL).
Run a separate search but stitch the output to the first search (using the command | append []).

In this case, you're best off running one report per output file. In order to simplify management, I'd suggest using macros which allow you factor out the common elements of the searches.

Help with subsearches

Follow this question

Splunk Resources

Related questions