topic Splunk Query in Splunk Enterprise Security

Splunk Query

rupeshn — Wed, 20 Nov 2019 10:18:47 GMT

Hi,

After Extracting a field using regex. I now need to compare whether that particular field contains any command . Could you please help how to proceed further using eval,match or any other way?

Re: Splunk Query

493669 — Wed, 20 Nov 2019 10:24:19 GMT

Hi @rupeshn,
Try below-

...| eval matches = if(match(fieldname,"command Line"), 1, 0)

If it find command line in fieldname then it will return 1 else 0

Re: Splunk Query

rupeshn — Wed, 20 Nov 2019 10:28:53 GMT

That can be any command. Can i write a regex for command in place of "command line". If yes, Could you please suggest.

Re: Splunk Query

493669 — Wed, 20 Nov 2019 10:39:12 GMT

Please provide more details on sample data and what output are you expecting

Re: Splunk Query

sanjeev543 — Wed, 20 Nov 2019 11:48:56 GMT

Hi,

You could write the regex to match the field values to capture the commands in your newly extracted field. See below,

| makeresults 
| eval commands="vi,cd,hello,world"
| makemv delim="," commands
| mvexpand commands
| rex field=commands "(?<abc>.*)"
| eval contains_command=if(match(abc,"vi|cd"),"Yes","No")

Here I have extracted field abc from field commands and then I used eval and simple regex using match function to identify the commands in field abc
If it's there then I will see result as yes and no respectively.