I'm reading in events from a lookup table and I'm trying to remove events using RegEx that meet criteria but can't get it to work. I want to remove any host that is an IP address. lookup file: host x.x.x.x hosta x.x.x.x hostb | inputlookup mylookup | regex host!="/^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$/" | table host With this I still get all events. thx. ... View more

hello, I have a lookup table that has host to user correlation... ex; Host, User hosta, user1 hostb, user2 hostb, user3 My understanding is that when I match on hostb via lookup below I will get field Authentication.user back as a multivalue field. But when I try to use 'mv' commands to get first user for hostb (user2) I get blank field for top_user. Why? thx. | makeresults | eval host="hostb" | table host | lookup host-to-users.csv Authentication.src as host OUTPUT Authentication.user | eval top_user=mvindex(Authentication.user,0) | table host Authentication.user top_user ... View more

I'm reading from a file that has messages like these: Action (0x00000173): x.x.x.x; |Performed by user "User 1" Action (0x00000173): host2.domain.com; |Performed by user "User 2" Action (0x00000173): host3.CA.domain.com; |Performed by user "User 3" After the lookup is done I have parsed out the host identifier (as either x.x.x.x, host2.domain.com, host3.CA.domain.com) as field host. Now I need to perform actions. If the host value is an IP address then do nothing. However, if the host value is not an IP address then strip off everything (and including .) after the first period. I think the replace command will work but not getting it right... I have: | eval host=if(match(host, "^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$"), host, replace(host, 'do something here', 'do somethinge here')) In the end I should I have: x.x.x.x host2 host3 Thank you ... View more

I have a field to evaluate if the value of the field is an IP address or a hostname. if it is an IP address do something, if it is a hostname do something else. Is there a eval function to check if field is IP or not? ... View more

Here is my date format I would like to convert to epoch for later processing. My date formate is: 3/5/2018 17:03 My commands below: | gentimes start=-1 | eval myDate="3/5/2018 17:03" | convert timeformat="%m/%d/%Y %H:%M" mktime(myDate) as epoch | table epoch Yields epoch of 1520287380, which is March 5, 2018 10:03:00 PM Any idea why it calculates 3 hours ahead? NOTE: I have set my timezone to my location. ... View more

Hi, I have a lookup table that consists of 1 column. It contains IP addresses. I have search against an index that has fields IP addresses and user Ids. I want to match the IPs in the search to the lookup column IP Address. If I find a match I want to output the user ID in the event only. How do I do that? Thx ... View more

Hi, I'm getting error at search time: Error in 'rex' command: Encountered the following error while compiling the regex '(?\d+.\d+.\d+.\d+)': Regex: syntax error in subpattern name (missing terminator) My rex expression is this: index=bcoat_eo | head 1 | rex field=_raw "(?\d+\.\d+\.\d+\.\d+)" Blue log snippet is : [18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED What am I doing wrong? Is it the '-' between the <>? If so how do i escape? Thanks ... View more