Splunk Search

Extreme search

Meena_0627
New Member

In extreme search, i would like to know what this statement means and how it is derived by Splunk

"xwhere count from count_by_signature_1h in ids_attacks by signature is above medium"

The above applies for src, dest_port etc. I wanna know how "medium" is calculated,

Tags (2)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

from - https://answers.splunk.com/answers/294454/splunk-app-for-enterprise-security-how-to-debug-xs.html
To view a context, you can use the command "xsDisplayContext". In the example you have above, you would run this search command:

   | xsDisplayContext 'count_by_signature_1h' in 'ids_attacks' by  'xy signature'

also please check this app - Extreme Search Visualization
https://splunkbase.splunk.com/app/2855/

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...