So I have some domain information that i'm attempting to format appropriately with EVAL functions either replace, or rtrim, and I seem to be having some difficulty.
I'm attempting to shave off t...
...s a bit complicated but I see reference to a checkpoint_dir setting (which I don't see set anywhere, nor can I tell what it defaults to) as well as it functions that look like they use the rest_api to s...
Hi,
I am having the following query:
index=* sourcetype=CustomAccessLog | table "host", "source"
The output is:
host
source
server32.de.db.com
/path/to/se...
...xcellent Custom Function that looks in the cached SOAR internals for the cached results from previous executions of a specific app/action. He did mention that this was a 'work in progress' and I can't find t...
I have subnet lookup in cidr notation. so i am trying to print subnet detail with dest ip but not getting result.
query:-
index=xyz | stats count by dest | lookup subnet.csv subnet as dest outp...
Can someone help me break down this portion of a search? Is it saying, look for anything older than 30 minutes? eval recent = if(latest > relative_time(now(),"-30m"),1, 0), realL...
...ny time. I have 3 of these types of conditions, but they are all under the same field name. The struggle for me is combining these if else functions into one multi conditional function. I have s...