...upposed to happen and investigate to fix
Types of Outputs: categorize # of specific event_identifier that occur in each cycle to create a baseline/statistical prediction based on event_identifier and...
...o a search. When I view the logs in Event Viewer on a test workstation I am seeing all the Logon Types. I have been searching a lot for answers and have tried every solution but none of them give me t...
Hi everybody,
The search I'm trying to create is to alert possible brute force attacks using WindowEventLogs.
I'd like to have a search (alert) that runs every hour and splits that hour i...
Hello!
I was wondering how to use a directory name (segment) as an event tag. For example:
C:\bin\code\python\test_system\scoring\results\16\17055079037\some files log files here or in d...
...orts 20,21,69) with a specific amount of data ( x mbs or y bytes ) using our Stream data. I'm not really sure how to build a correlation search to accomplish that but in that, I have a search I've built f...
Hi everyone,
I am trying to configure one way to segment syslog events by user.
Example:
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP01|...
Apr 11 13:30:38 10.0.11...
...nterprise Security. So something that will iterate all entries in the lookup andsearch against the assets index using hostname.
Im not sure how to best go about this, should I be using a s...
...isplay all the events that contain a common value of field1. Example - 17/2 AAA BBB gfg 17/2 XXX VVV hjh 17/2 AAA MMM klk Searching BBB will display this lines (that have AAA in common) - 17/2 AAA B...
Hoping someone can help, reasonably new to Splunk.
I have a number of Splunk events that are uploaded small text files. Is there a way I can search inside these uploaded files explicitly? In my c...
Hello Splunkers,
I've got a search built thats working properly but I'm not able to get the events with a particular blank field excluded. In particular, I'm trying to exclude events that have a b...