All Apps and Add-ons

Splunk for Asset Discovery: How to fix search syntax for port signatures panel?

peter_royle
Engager

the port signatures panel of the port overview dashboard is not working
The search string is:

eventtype=port_scan "Linux 2.6.32 - 3.10" | stats dc(dest_ip) as count by port_signature | where match(port_signature, replace(replace(""Linux 2.6.32 - 3.10"", "\s*OR\s*", "|"), "*", ".*")) | sort - count

The error is:

Error in 'where' command: The expression is malformed. Expected LIKE.

I get the problem just can't work out where to put the LIKE

Anyone?

Kind Regards
Peter

1 Solution

pmdba
Builder

The problem is in your second "replace()" call. The "Linux 2.6.32 - 3.10" term should only be contained in a single set of double-quotes, not two sets.

What you have:

eventtype=port_scan "Linux 2.6.32 - 3.10" | stats dc(dest_ip) as count by port_signature | where match(port_signature, 
replace(replace(""Linux 2.6.32 - 3.10"", "\s*OR\s*", "|"), "\*", ".*")) | sort - count

What it should be:

eventtype=port_scan "Linux 2.6.32 - 3.10" | stats dc(dest_ip) as count by port_signature | where match(port_signature, 
replace(replace("Linux 2.6.32 - 3.10", "\s*OR\s*", "|"), "\*", ".*")) | sort - count

View solution in original post

pmdba
Builder

The problem is in your second "replace()" call. The "Linux 2.6.32 - 3.10" term should only be contained in a single set of double-quotes, not two sets.

What you have:

eventtype=port_scan "Linux 2.6.32 - 3.10" | stats dc(dest_ip) as count by port_signature | where match(port_signature, 
replace(replace(""Linux 2.6.32 - 3.10"", "\s*OR\s*", "|"), "\*", ".*")) | sort - count

What it should be:

eventtype=port_scan "Linux 2.6.32 - 3.10" | stats dc(dest_ip) as count by port_signature | where match(port_signature, 
replace(replace("Linux 2.6.32 - 3.10", "\s*OR\s*", "|"), "\*", ".*")) | sort - count

View solution in original post

peter_royle
Engager

Thanks that works

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!