Splunk Search

How to combine two datamodels in the tstats command? I want to merge them to capture DCOM lateral movement events.

quangnm21
Explorer

quangnm21_0-1705468371876.pngquangnm21_1-1705468387614.png

I want to combine these two events. Can anyone help me? I have tried using the join and append commands, but haven't been successful.

I want to analyze data in the 'Endpoint' model to capture information related to 'mmc' and then compare the 'ID' to retrieve IP and port information from the 'Network' model.

Labels (2)
Tags (3)
0 Karma

quangnm21
Explorer

quangnm21_0-1705476542927.png

It did not work correctly

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...