Can you help me fix my search

[NeAllen]

Hi,

Below is my current search at the moment, 

index=o365 sourcetype=* src_ip="141.*"
| rex field=_raw "download:(?<download_bytes>\d+)"
| rex field=_raw "upload:(?<upload_bytes>\d+)"
| dedup UserId, ClientIP
| table UserId, download_bytes, upload_bytes
| head 10

I am trying to get downloaded bytes and uploaded bytes into a table and find out if anything suspicious is going on in the network however I have been unable to return anything other than the source ip.

Thanks in advance.

[gcusello]

Hi @NeAllen ,

to debug your search I need some sample of your logs to check the regexes.

Then I see a strange thing.

when using head you shuld sort to that the most relevant events and not only then events.

So osrting e.g. for the sum of download_bytes and upload_bytes, you coulr run something like this:

index=o365 sourcetype=* src_ip="141.*"
| rex field=_raw "download:(?<download_bytes>\d+)"
| rex field=_raw "upload:(?<upload_bytes>\d+)"
| eval total_bytes=download_bytes+upload_bytes
| sort 10 -total_bytes
| table UserId total_bytes download_bytes upload_bytes

Ciao.

Giuseppe

[inventsekar]

Hi @NeAllen .. you may need only one rex command (with two matchings inside that single rex).

the sample logs are needed, then only we can troubleshoot why the rex is not working as expected. thanks. 

[yuanliu]

Pro tip: To get help about data analytics, present sample data (in text, anonymize as needed), illustrate desired output (in text), and describe the logic between the data and output.  If you have a command that does not give the desired output, illustrate the actual output (anonymize as needed) and explain why it is different from desired output if not painfully obvious).