topic Re: Fieldsummary output : remove columns I dont need. in Splunk Enterprise Security

Fieldsummary output : remove columns I dont need.

john_shashank — Wed, 30 Sep 2020 05:11:36 GMT

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m
| fieldsummary

output: A table contains multiple columns such as field, count, distinct_count, is_exact, .......etc.

Required output: only one column.

Not working :
|table -count, -distinct_count,

Re: Fieldsummary output : remove columns I dont need.

to4kawa — Fri, 01 May 2020 09:35:49 GMT

use fields instead of table

Re: Fieldsummary output : remove columns I dont need.

codebuilder — Fri, 01 May 2020 16:43:02 GMT

In your example, table will work but your syntax is not correct. Use table to include the values you want.

e.g.

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m| fieldsummary | table field, count, max

Re: Fieldsummary output : remove columns I dont need.

john_shashank — Wed, 30 Sep 2020 05:11:43 GMT

Thanks, that worked,

I have one more question if you can help.

Query:
eventtype=osquery_osquery earliest=-5m
| stats values(fieldsummary) by name
[ | fieldsummary

| fields - count, - distinct_count, - is_exact, - max, - mean, - min, - numeric_count, - stdev, - values]

Looking for the result as :
2 column: name and the field (one column from the fieldsummary search)

Can you help me to modify the query to get the correct answer?

Thanks

Re: Fieldsummary output : remove columns I dont need.

codebuilder — Fri, 01 May 2020 18:33:20 GMT

Did you read my answer?

Re: Fieldsummary output : remove columns I dont need.

to4kawa — Fri, 01 May 2020 20:45:11 GMT

@john_shashank
please accept my answer.

Your query is not clear. What are you going to know by this query?

ask for another question and provide sample log at the point.

Anyone can't see name and why do you use fieldsummary at this place?
osquery's output has name , I know. but I can't understand what you want to do.

@codebuilder
remove columns I dont need
For this Q, fields is appropriate. so, I think table is good, too.

Re: Fieldsummary output : remove columns I dont need.

codebuilder — Sat, 02 May 2020 02:17:00 GMT

@to4kawa I agree with you, both options work in this case (fields or table), and your suggestion was first, and correct.

Re: Fieldsummary output : remove columns I dont need.

john_shashank — Wed, 30 Sep 2020 05:11:52 GMT

Your command worked completed fine. but as there are multiple packs under the field called "name". I modified the query to the following which did not work for me can you help me with that?

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m| fieldsummary | stats value(field), name

Re: Fieldsummary output : remove columns I dont need.

john_shashank — Sat, 02 May 2020 05:24:20 GMT

I am trying to achieve something like in the picture below.
https://drive.google.com/open?id=1Atr-qDM68Dc_pLy7WsGFeiFbiEvvjha2

this is what I just created for an example. @to4kawa If there is any other way to extract field please feel free to share the syntax. thanks

Re: Fieldsummary output : remove columns I dont need.

to4kawa — Sat, 02 May 2020 09:00:52 GMT

Your query is not clear. What are you going to know by this query? ask for another question and provide sample log at the point.

another way:

use map and search each name.

Re: Fieldsummary output : remove columns I dont need.

codebuilder — Wed, 30 Sep 2020 05:17:50 GMT

Yes. Take out the "name=", and instead use wildcards around the values.
e.g.
pack_incident_response_

Do the same for any others you want to include.

Re: Fieldsummary output : remove columns I dont need.

codebuilder — Tue, 05 May 2020 15:05:23 GMT

To clarify my previous post, try this method:

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m| fieldsummary *pack_incident_response_* | table field, count, max