Splunk Search

How to use action="blocked" on search bar ?

Nasser
Explorer

I have file.csv and I want to do an action, action="blocked" but it appears to me there is no result after searching so is there any a way to help me?Screenshot 2023-02-02 192507.png

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Nasser,

booleans operators must be used in UPPERCASE, in addition the AND operator is mandatory only in eval.

This means that you're searching using as additional conditions: action="blocked" and the word "and".

Ciao.

Giuseppe 

View solution in original post

ghaidaqader
New Member

Hi Nasser I am taking the same course I tried multiple queries nothing worked can you help me

source="3--المصدر-الداعم-الثالثسجل-الملفات.csv" host="Ghaidas-MBP" index="main" sourcetype="stc_logs" action="blocked"     

                   

I used this Query as well to count action 

source="3--المصدر-الداعم-الثالثسجل-الملفات.csv" host="Ghaidas-MBP" index="main" sourcetype="stc_logs" | stats count by action

 

but neither queries have yielded any results 

0 Karma

Nasser
Explorer

try this

booleans operators must be used in UPPERCASE, in addition the AND operator is mandatory only in eval.

This means that you're searching using as additional conditions: action="blocked" and the word "and".

Ciao.

0 Karma

abdullahR
New Member

hello Nasser can you help me on this?

0 Karma

Nasser
Explorer

Thanks a lot it helped me

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Nasser,

booleans operators must be used in UPPERCASE, in addition the AND operator is mandatory only in eval.

This means that you're searching using as additional conditions: action="blocked" and the word "and".

Ciao.

Giuseppe 

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...