Hi, Now since I am getting the result and to make it more flexible, in dashboard, I want to add input textbox where we can search via field values in application so for any particular value I can write in search box and run the query. e.g. if my field2 contains abc ; I want to type abc is search box and click submit and all results containing abc of that field will pull out the report. Can anyone please help in that. Thanks & Regards, Binay Agarwal ... View more

Hi @somesoni2, Thank You so much. This is exactly needed 🙂 A BIG THANK YOU once again. 🙂 Best Regards, Binay Agarwal ... View more

Hi @Damien Dallimore [Splunk], I tried for similar outcome to search my query ; however no result is found. Note: In my .csv file there is only one column and it looks like below: Application abc* xyz* aaa* n so on. Query is index="index_name" [ | inputlookup "filename" | fields Application ] | table field1, field2 Anything I am missing. Kindly help. Thanks & Regards, Binay Agarwal ... View more

Hi Giuseppe, Thanks for response. The link you have given is no longer available. 😞 In the query index=your_index [| inputlookup your_lookup | rename keyword AS query | fields query ] | table .... didn't understand much the below part rename keyword AS query | fields query ] . Does it mean all the keywords need to be write in rename .. or any other better way we can present Once again, thank you so much for the response. Regards, Binay Agarwal ... View more

Hi @btorresgil, Thank You for your response. Will try this also 🙂 However, would be prefer to get the URL links and view without using Palo Alto Networks App. Thanks & Regards, Binay Agarwal ... View more

Hello @skoelpin , Can you please help in writing the regex or do you need any more details. Thanks & Regards, Binay Agarwal ... View more

Hello Skoelpin, Thank You for your response. Here is the 2 sample data: Just have replaced some information with <>. Hope it helps to extract the URL field using a regular expression . If not, please let me know any specific sample you need. ======================== 2016-10-25T10:57:02+00:00 Palo Alto Networks|PAN-OS Syslog Integration|4.0| deny|cat=TRAFFIC|src=|dst=|srcPort=<>|dstPort=23|proto=tcp|usrName=| SerialNumber=007801003272|Type=TRAFFIC|Subtype=drop|srcPostNAT=0.0.0.0|dstPostNAT=0.0.0.0|RuleName=DENY-ALL| SourceUser=|DestinationUser=|Application=not-applicable| VirtualSystem=<>|SourceZone=internet|DestinationZone=public03| IngressInterface=<>|EgressInterface=|LogForwardingProfile=log-all-to-panorama-and-ext|SessionID=0|RepeatCount=1|srcPostNATPort=0| dstPostNATPort=0|Flags=0x0|totalBytes=64|totalPackets=1|ElapsedTime=0|URLCategory=any|dstBytes=0|srcBytes=64|action=deny ======================================================== 2016-10-25T10:57:02+00:00 Palo Alto Networks|PAN-OS Syslog Integration|4.0|allow|cat=TRAFFIC|src=|dst=|srcPort=<>|dstPort=443|proto=tcp|usrName=| SerialNumber=007801003272|Type=TRAFFIC|Subtype=end|srcPostNAT=|dstPostNAT=|RuleName=5-1|SourceUser=|DestinationUser=|Application=google-base| VirtualSystem=vsys1|SourceZone=office|DestinationZone=internet|IngressInterface=ae2.431|EgressInterface=ae1.633|LogForwardingProfile=log-all-to-panorama-and-ext|SessionID=76241|RepeatCount=1| srcPostNATPort=<>|dstPostNATPort=443|Flags=0x40001a|totalBytes=2067|totalPackets=18|ElapsedTime=126|URLCategory=search-engines|dstBytes=770|srcBytes=1297|action=allow Thanks & Regards, Binay Agarwal ... View more

Hi , Thanks for your response. Specified timerange if I choose one of todays date then only I am getting the result. e.g. If I choose date e.g. 17th Oct - 24th Oct(today's date) getting the result . But if choose any other date between e.g. 17th Oct - 23rd Oct(not today's date) ; or 21st Oct - 23rd Oct ( not today's date) it is displaying as no result found. And I ran the query : index=<> host=<> | sort _time The first event displayed of todays date. And I just cross-checked. Only today's date result is displaying not for any other date ( same for the query I written) Can you please help why it is so as I have written the query and where to correct. It will be really helpful. Thanks & Regards, Binay Agarwal ... View more

Which version of the TA_linux-auditd app is installed? Current Application: Linux Auditd App Version 2.0.2 Which version of the CIM app is installed? Target CIM version: 4.3.1 Current Application: SA-cim_validator App Version 1.0 App Build 1 If you run the search: eventtype=auditd_events in "Smart Mode", do you see the normal list of fields on the left-hand side? Yes, can see only on Search & Reporting app and Linux_auditd app. But there is no search result in CIM app and ES app. Please help. ... View more

@javiergn: Thanks a lot!! It works perfectly.. ... View more

Thank You so much for your response. I simply want that the value /pts/0, /pts/1, and so on should be considered as expected value as per CIM data model so can have 100 % CIM compliance for this field. ... View more

Thanks a lot!! It helps 🙂 ... View more

Thank You so much!! However , it is also not giving the desired result. Is it something that the null value can only be replaced in raw data ? I am not sure though. ... View more

Thanks!! I have tried with the below combination : if(isnull(src) OR src=='?',"unknown",src) The result is coming correct but again replaces other values also as unknown. Is it something it is considering '?' as regex value and if yes how we can nullify it and consider as the value of src. ... View more

Thanks!! However , I want to replace value of src = ? to unknown and for that I wrote the expression as like this: if(isnull(src) OR src="?","unknown",src) ; however it is taking the value but it replaces all other src values to unknown too. e.g if src = 172.*.*.* any IP address; it also replaces to unknown. I tried with other way also ; but same result I am getting. if(isnull(src) OR src=="\?","unknown",src) if(isnull(src) OR src=="?","unknown",src) Basically, I want only value "?" should be replaced with unknown. If anyone can tell, it would be really help. Thanks in advance. ... View more