- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Extreme search
Meena_0627
New Member
09-01-2016
05:05 AM
In extreme search, i would like to know what this statement means and how it is derived by Splunk
"xwhere count from count_by_signature_1h in ids_attacks by signature is above medium"
The above applies for src, dest_port etc. I wanna know how "medium" is calculated,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
inventsekar

SplunkTrust
09-01-2016
08:17 AM
from - https://answers.splunk.com/answers/294454/splunk-app-for-enterprise-security-how-to-debug-xs.html
To view a context, you can use the command "xsDisplayContext". In the example you have above, you would run this search command:
| xsDisplayContext 'count_by_signature_1h' in 'ids_attacks' by 'xy signature'
also please check this app - Extreme Search Visualization
https://splunkbase.splunk.com/app/2855/
thanks and best regards,
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
