All of the Event's in Splunk have MAL,WM,W32,Troj,CXmal,JS,or Vir in their name. Is there a way to separate all of these by type, or just look for a single type?
ie: See how many Malware have popped up in the last 24 hours
It helps a bit. My primary problem is that I want to run a query, for say the following..
Certain department
Query for Malware
Query for Virus
Query for Trojans
Right now, all of it is grouped together into events.
It helps a bit. My primary problem is that I want to run a query, for say the following..
Certain department
Query for Malware
Query for Virus
Query for Trojans
Right now, all of it is grouped together into events.
you can use tags http://docs.splunk.com/Documentation/Splunk/4.2.5/Knowledge/Abouttagsandaliases then do searches,reports on tags
antifreke,
You should setup a field extraction (docs: here) to extract the types mentioned above, via regular expressions... If you do not have experience with this (especially in Splunk), you should probably start with Splunk's IFX (Interactive Field eXtractor, in the link above).
Once you have setup this field extraction, you'll be able to perform a search similar to this:
base_search | stats count by field_extracted
For example, if your sourcetype is "malware", and you've named the extracted field "vuln", the search would be:
sourcetype=malware | stats count by vuln
The easiest way to modify your time range is with the default time range picker in the search view (flashtimeline).
Hope this helps,
MHibbin