All Posts

mark_groenveld · ‎11-08-2023

Thanks Robert. I would like to clarify the search as I need the events less than the p95 duration. Shouldn't the eval section be: | eval search = "dur<"+p95Dur

m_pham · ‎11-08-2023

Try this - I'm not the best at regex and someone else may come along and provide a more efficient one. Registrar: (?<registrar>.+[^\s]).+Registrar ID

mark_groenveld · ‎11-08-2023

Thanks for your response Rich. Using eventstats took too long to complete to the point it wasn't usable.

scout29 · ‎11-08-2023

i am looking for the field registrar to be extracted. There are three spaces after the registrar string - but i cant seem to write my regex to capture the full registrar name up to the three spaces. ...

i am looking for the field registrar to be extracted. There are three spaces after the registrar string - but i cant seem to write my regex to capture the full registrar name up to the three spaces. I am using this but not getting the full string extracted \sRegistrar:\s(?<registrar>\w+\s\w+)

m_pham · ‎11-08-2023

Try adding this to your search | rex field=_raw "Registrar ID: (?<registrar_id>\S+)" Update: I misread your post, standby for an updated search to include all three field extraction - unless someo...

Try adding this to your search | rex field=_raw "Registrar ID: (?<registrar_id>\S+)" Update: I misread your post, standby for an updated search to include all three field extraction - unless someone else beat me to it. You can also use the "Extract New Fields" or "Event Actions" option when you run your search.

richgalloway · ‎11-08-2023

I masked the IP address in this reply.

scout29 · ‎11-08-2023

I am trying to write a regex to extract a field called "registrar" from some data like i have below. Can you please help how i could write this regex to be used in a rex command to extract the field?...

I am trying to write a regex to extract a field called "registrar" from some data like i have below. Can you please help how i could write this regex to be used in a rex command to extract the field? Below are three example events: Registry Date: 2025-10-08T15:18:58Z Registrar: ABC Holdings, Inc. Registrar ID: 291 Server Name: AD12 Registry Date: 2025-11-08T15:11:58Z Registrar: OneTeam, Inc. Registrar ID: 235 Server Name: AD17 Registry Date: 2025-12-08T15:10:58Z Registrar: appit.com, LLC Registrar ID: 257 Server Name: AD14 I need the regex to use to extract the field called "registrar" which in the above example would have the following three value matches: ABC Holdings, Inc. OneTeam, Inc appit.com, LLC

varma364 · ‎11-08-2023

lkjnhqaf lkjqq

kc_prane · ‎11-08-2023

Hello, Currently, I am using the append command to combine two queries and tabulate the results, but I see only 4999 transactions. Is there any way I can get full results? Thanks in advance!

richgalloway · ‎11-08-2023

To test parsing you can use regex101.com or use the rex command in a search window. | rex mode=sed "<<sed string to test>>" Creating a User and/or Group field would be a challenge since the cs2 fie...

To test parsing you can use regex101.com or use the rex command in a search window. | rex mode=sed "<<sed string to test>>" Creating a User and/or Group field would be a challenge since the cs2 field could contain either a user or a group name and Splunk has no way to know which.

richgalloway · ‎11-08-2023

Jobs should be removed from the dispatch directory automatically once they expire. Some workarounds to consider: Increase the size of the dispatch directory Reduce how frequently datamodel accele...

Jobs should be removed from the dispatch directory automatically once they expire. Some workarounds to consider: Increase the size of the dispatch directory Reduce how frequently datamodel accelerations run Disable unused DMAs

PickleRick · ‎11-08-2023

It does not look like any standard Splunk Windows-related sourcetype so it's hard to say from experience. You need to find the source of the file yourself. It might be either an indexed field or sear...

It does not look like any standard Splunk Windows-related sourcetype so it's hard to say from experience. You need to find the source of the file yourself. It might be either an indexed field or search-time extraction (for which you can just brute-force grep all your .conf files if all else fails).

PickleRick · ‎11-08-2023

As long as you tell us what data you have that should have this information and say how would you detect it from said data. Oh, and firstly please define what do you mean by "half duplex connection ...

As long as you tell us what data you have that should have this information and say how would you detect it from said data. Oh, and firstly please define what do you mean by "half duplex connection from source to destination".

virginiatech199 · ‎11-08-2023

Does anyone know a pattern for detecting half-duplex connections from server/laptop sources to server destinations? not switches, not routers. I am Splunk Cloud Version: 9.0.2305.101

lorinj62 · ‎11-08-2023

Thanks all. I ended up using a modified version of @FelixLeh ....it works well!

m_pham · ‎11-08-2023

Hi - can you post name of the sourcetype to the event where EventID=4647 comes up? You can then search for the sourcetype name in Splunk_TA_windows/default/props.conf to see how signature_id field is...

Hi - can you post name of the sourcetype to the event where EventID=4647 comes up? You can then search for the sourcetype name in Splunk_TA_windows/default/props.conf to see how signature_id field is created.

bishopolis · ‎11-08-2023

No, let's not let this one fade out. - the question is relevant - the context is relevant, as is the history - the goal is as trivial now, as then, to achieve - the continued "any day now" feeling is ...

No, let's not let this one fade out. - the question is relevant - the context is relevant, as is the history - the goal is as trivial now, as then, to achieve - the continued "any day now" feeling is important Bump this one. Maybe it's okay for still-relevant issues to be still-relevant, even if it's hard for a small number of us to value something more than a fortnight old. Thanks for your suggestion.

ITWhisperer · ‎11-08-2023

Try something like this index=A (sourcetype=signlogs outcome=failure) OR (sourcetype=accesslogs) | eval processId=coalesce(processId, SignatureProcessId) | eventstats values(userId) as userId by pro...

Try something like this index=A (sourcetype=signlogs outcome=failure) OR (sourcetype=accesslogs) | eval processId=coalesce(processId, SignatureProcessId) | eventstats values(userId) as userId by processId

Dharani · ‎11-08-2023

Hi, My main goal is to find user id. Index=A sourcetype=signlogs outcome=failure The above search has a field name called processId but it doesn't have the userId which I needed. Index=A sourcet...

Hi, My main goal is to find user id. Index=A sourcetype=signlogs outcome=failure The above search has a field name called processId but it doesn't have the userId which I needed. Index=A sourcetype=accesslogs -->This search has a SignatureProcessId( which is same as processId in the search1) and also it has userId. So I need to join these 2 query with common field as processId/SignatureProcessId I tried the below query but it results 0 events: Index=A sourcetype=signlogs outcome=failure | dedup processId | rename processId as SignatureProcessId | join type=inner SignatureProcessId [Index=A sourcetype=accesslogs | dedup SignatureProcessId ] | Table _time, SignatureProcessId, userId Someone please help with fixing this query.

m_pham · ‎11-08-2023

Are you still having this issue with the latest SSE app v3.7.1?

All Posts

All Posts

Re: How can I find an event count of event that are less than a p95 duration?

Re: Trying to create a custom Field Extraction

Re: How can I find an event count of event that are less than a p95 duration?

Re: Trying to create a custom Field Extraction

Re: Trying to create a custom Field Extraction

Re: Is there an effective way of merging 2 splunk searches?

Trying to create a custom Field Extraction

Re: Is there an effective way of merging 2 splunk searches?

Splunk Search results limit 4999

Re: How do we Parse logs of Secret Server in Splunk Cloud

Re: Many bad alloc errors, dispatch directory fills up and does not free up space for other jobs

Re: How is Splunk creating the signature_id field for Windows Event Logs?

Re: way to detect half-duplex connections

way to detect half-duplex connections

Re: parse ps command

Re: How is Splunk creating the signature_id field for Windows Event Logs?

Re: Is there a yum/rpm repo for Splunk?

Re: Join 2 searches which has common fields as 2 different field name with same value

Join 2 searches which has common fields as 2 different field name with same value

Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials

All Posts

Are you a member of the Splunk Community?

All Posts