Seperation by Type

[antifreke]

All of the Event's in Splunk have MAL,WM,W32,Troj,CXmal,JS,or Vir in their name. Is there a way to separate all of these by type, or just look for a single type?

ie: See how many Malware have popped up in the last 24 hours

[antifreke · Accepted solution]

It helps a bit. My primary problem is that I want to run a query, for say the following..

Certain department
Query for Malware
Query for Virus
Query for Trojans

Right now, all of it is grouped together into events.

[MarioM]

you can use tags http://docs.splunk.com/Documentation/Splunk/4.2.5/Knowledge/Abouttagsandaliases then do searches,reports on tags

[MHibbin]

antifreke,

You should setup a field extraction (docs: here) to extract the types mentioned above, via regular expressions... If you do not have experience with this (especially in Splunk), you should probably start with Splunk's IFX (Interactive Field eXtractor, in the link above).

Once you have setup this field extraction, you'll be able to perform a search similar to this:

base_search | stats count by field_extracted

For example, if your sourcetype is "malware", and you've named the extracted field "vuln", the search would be:

sourcetype=malware | stats count by vuln

The easiest way to modify your time range is with the default time range picker in the search view (flashtimeline).

Hope this helps,

MHibbin