Splunk Search

Seperation by Type

antifreke
Path Finder

All of the Event's in Splunk have MAL,WM,W32,Troj,CXmal,JS,or Vir in their name. Is there a way to separate all of these by type, or just look for a single type?

ie: See how many Malware have popped up in the last 24 hours

Tags (1)
0 Karma
1 Solution

antifreke
Path Finder

It helps a bit. My primary problem is that I want to run a query, for say the following..

Certain department
Query for Malware
Query for Virus
Query for Trojans

Right now, all of it is grouped together into events.

View solution in original post

0 Karma

antifreke
Path Finder

It helps a bit. My primary problem is that I want to run a query, for say the following..

Certain department
Query for Malware
Query for Virus
Query for Trojans

Right now, all of it is grouped together into events.

0 Karma

MarioM
Motivator
0 Karma

MHibbin
Influencer

antifreke,

You should setup a field extraction (docs: here) to extract the types mentioned above, via regular expressions... If you do not have experience with this (especially in Splunk), you should probably start with Splunk's IFX (Interactive Field eXtractor, in the link above).

Once you have setup this field extraction, you'll be able to perform a search similar to this:

base_search | stats count by field_extracted

For example, if your sourcetype is "malware", and you've named the extracted field "vuln", the search would be:

sourcetype=malware | stats count by vuln

The easiest way to modify your time range is with the default time range picker in the search view (flashtimeline).

Hope this helps,

MHibbin

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...