splunk wildcard search

[Mouseman123]

I am very new to SPLUNK and practicing using the botsv1 index.

I need to use a "Wild Card" to find all the passwords used against a destination IP.

I know I need to use the http_method= Post and search for the user passwords within the form_data field.

I have been experimenting with the SPL command but no success as of yet

[Mouseman123]

The dataset I am using is "Boss of the Sock Version 1" - "botsv1"

Index="botsv1"

My assessment question is as follows:
Use a "wild card" search to find all passwords used against the destination IP. As a hint, you will need to use a specific http_method= as the attack was against a web server. You will also need to pipe the result into a search that uses the form_data field to search for user passwords within the form_data. What is the SPL statement used?

Warning!
My SPL may be all over the place but here it is:

Index="botsv1" dest_ip="192.168.250.70"  "http_method=POST form_data"*" source:"stream:http"

| table form_data, src_ip, password

I am very new here!
Your help is much appreciated

[ITWhisperer]

So, what events are returned from the first part of your search with http_method="POST"?

[ITWhisperer]

Since everyone is not familiar with the data set you are referring to, please can you provide some examples of the events you are trying to find. Also, please share the SPL you have already tried, so we can see where you might be going wrong.

[Mouseman123]

Sorry,

I assumed the dataset "botsV1" was very widely known.

Thankyou for responding to my question however I have been able to solve the issue.