I have the following search in which I match up the user field from the lookup to the index, getting the top return of only the admin accounts: index=foo [| inputlookup admin_accts | fields user ] | stats count by user | sort -count The lookup admin_accts also has three other fields - "Last Name", "First Name", and "Role". How do I modify the search so that those three additional fields are listed in the results? Thx ... View more

I have the following search that shows users who are continuously being infected over a 30 day period: index=foo | stats count range(_time) as TimeRange by user src app app:category app:subcategory threat url | where TimeRange>1800 | where NOT zone="null" | eval TimeRange_In_Hours = round(TimeRange/3600,2), TimeRange_In_Days = round(TimeRange/3600/24,2) is it possible to show the avg count within the time range being returned per user? Thx ... View more

After updating to Splunk 7.2 and updating the Splunk Add-on for Juniper a few weeks ago, I noticed that the 'src' field is no longer listed even though it's still a field extraction and checking to see if perhaps it wasn't a field that was selected, but even in that screen the only field showing is src_port. When I click 'Extract new fields' the value for the event selected shows src being an existing extracted field and when I open that field extraction, it does have the K/V info for src extracted. Any ideas? ... View more

What would be the best way to search for anomalies/outliers for HTTP request character length by source IP? Looking for HTTP requests whose standard deviation may indicate a potential hack/indicator of compromise. Thx ... View more

I am using the transaction command to follow the sequence of a successful WordPress login (and the URIs the user hits after the login) and what I'm finding is that the endswidth is hard to pin down because of re-direction or no re-direction based on the site. So, I have the following logic: A method of POST with a status of 302 followed by a method of a GET within one second to the same site/IP Would a search based on transaction be needed for that, or is there a less taxing way to search for that sequence? Thx ... View more

I am running two different searches (Last 7 days) to determine the statistical anomalies for HTTP POSTS within 1 minute. basically looking for any potential anomalous posts that are making past the WAF. The first search uses ML and is as follows: index=foo | bucket _time span=1m | stats count by _time src | eventstats avg("count") as avg stdev("count") as stdev by "src" | eval lowerBound=(avg-stdev*exact(2)), upperBound=(avg+stdev*exact(2)) | eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, 1, 0) | splitby("src") | fields _time, src, "count", lowerBound, upperBound, isOutlier | where isOutlier=1 The second search is looking for Z scores: index=foo | bucket _time span=1m | stats count by _time src website | eventstats mean("count") AS mean_count, stdev("count") AS stdev_count | eval Z_score=round(((count-mean_count)/stdev_count),2) | where Z_score>1.5 OR Z_score<-1.5 | table _time, src, website, count, mean_count, Z_score | sort -Z_score Comparing the results of both searches returns different external IPs. Out of a total of 111 distinct IPs, only 12 IPs overlap between the two searches. The first question I have is are both searches an apple to apple comparison? The second question I have is, is one search more valid than the other, or is running both searches and looking for IPs that overlap a more concise way to evaluate the statistical anomalies for HTTP posts by external IPs? Thx ... View more

I have an anomaly search using Haversine against an index and one thing I'm running into is when a primary or secondary IP is flagged, but it's from a range of wireless IPs/networks from a provider. Does this addon provide the ISP information? Thx ... View more

I installed the URL Parser add on, but it appears that the lookup faup does not exist. Do I need to kick the script off manually? Thx ... View more