About Michael_Schyma1

Michael_Schyma1 · ‎07-23-2012

Thank you for your response

Michael_Schyma1 · ‎07-20-2012

07/20/2012 05:19:38 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4726 EventType=0 Type=Information ComputerName=DCSERVER TaskCategory=User Account Management OpCode=Info RecordNumber=17011111115 Keywords=Audit Success Message=A user account was deleted. Subject: Security ID: DOMAIN\SECID Account Name: SECID Account Domain: DOMAINNAME Logon ID: 0x6e46ffd0 Target Account: Security ID: S-3-5-21-2246893-1118314593-79235642-331713 Account Name: acctname Account Domain: DOMAIN Additional Information: Privileges - We are able to parse the message for Account Name, but both account names are in the results: SECID acctname We would like to create a field extraction to provide only the second Account Name: acctname acctname We would like to create a regex expression for this since the change to the prop did not work. Thank you for any help that can be given.

Michael_Schyma1 · ‎07-20-2012

index="Server" ( CategoryString="Account Management" OR TaskCategory="Security Group Management" ) (Message="Security Enabled*" OR Message="A member was added to a*" OR Message="A member was removed from a*") ("EventCode=624" OR "EventCode=630" OR "EventCode=4720" OR "Eventcode=4726") | eval caller = if(isnull(Account_Name), Caller_User_Name, mvindex(Account_Name,0)) | eval member = if(isnull(Account_Name), Member_Name, mvindex(Account_Name,1)) | eval group = if(isnull(Target_Account_Name), Group_Name, Target_Account_Name) | rex field=_raw "CN=(?<cname>.+?)," | rex field=_raw "Message=A security-enabled .* was (?<action>.+?)\." | rex field=_raw "was (?<details>\S+)"| table _time host caller details cname| rename _time AS Date/Time cname AS User group AS Group caller AS "Initiator" name AS "Description" host AS "DC" Security_ID AS "Initiator" details AS Action | convert timeformat="%m/%d/%Y %H:%M:%S %p" ctime(Date/Time) I can not get the removed field to work, when i put the proper event codes that I want. Does anyone have any suggestions?

Michael_Schyma1 · ‎07-19-2012

Any suggestions?

Michael_Schyma1 · ‎07-19-2012

rex field=_raw "Message=A user account was.*(?<accaction>.+?)\." 07/19/2012 11:32:19 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4740 EventType=0 Type=Information ComputerName=servername.domain.com TaskCategory=User Account Management OpCode=Info RecordNumber=2363332024 Keywords=Audit Success Message=A user account was locked out. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: SERVERNAME$ Account Domain: COMPANYNAME Logon ID: 0x4e7 Account That Was Locked Out: Security ID: DOMAIN\ACCOUNT Account Name: ACCOUNT Additional Information: Caller Computer Name: COMPUTERNAME All I am getting is the first and last letter. I want it to it to display locked or unlocked.

Michael_Schyma1 · ‎07-17-2012

I did lol but i still dont see the fields displaying in my chart below the search

Michael_Schyma1 · ‎07-17-2012

because i was going to add it in eventually, but i cant even get the feilds to display

Michael_Schyma1 · ‎07-17-2012

at the top command

Michael_Schyma1 · ‎07-17-2012

I just want to display all of the feilds, i do not even need the top function yet.

Michael_Schyma1 · ‎07-17-2012

index="Server" (CategoryString="Account Management" OR TaskCategory="Security Group Management" ) (Message="Security Enabled*" OR Message="A member was added to a*") ( EventCode=632 OR EventCode=636 OR EventCode=4728 OR EventCode=4732) | top member, group, caller, name, host, Security_ID | fields member, group, caller, name, host, Security_ID| eval caller = if(isnull(Account_Name), Caller_User_Name, mvindex(Account_Name,0)) | eval member = if(isnull(Account_Name), Member_Name, mvindex(Account_Name,1)) | eval group = if(isnull(Target_Account_Name), Group_Name, Target_Account_Name) | search group="*Domain Admins" OR “*Administrators” OR “*ACCOUNT OPERATORS” OR “*Enterprise Admins” OR “*Schema Admins”| rename _time AS Time member AS Username group AS Group caller AS "Action by" name AS "Description" host AS "DC" Security_ID AS "Initiator Details" | convert timeformat="%m/%d/%Y %H:%M:%S %p" ctime(Time) I am having a hard time figuring out why no information is being displayed through the top and fields command.

Michael_Schyma1 · ‎07-16-2012

index=hig `sourcetype="MainframeApps" |stats sum(count)|top limit=0 app_id app_name | fields + count, total_count, percent,app_name, app_id | accum count AS total_count | rename total_count AS "Total Count" app_id AS "App Code" app_name AS "Application Name" count AS "Number of Events" percent AS "Percent" I can not figure out why i can not get the sum function to work? any suggestions

Michael_Schyma1 · ‎07-16-2012

Thank you for trying, i dont know why i am not getting the same results

Michael_Schyma1 · ‎07-16-2012

I do want a total count feild that populates how many events are generated from our system. I dont understand how i am not seeing any other fields but a total count when i add the stat function. I just wanted to add the total field to what i had originally. I can not take screenshots here.

Michael_Schyma1 · ‎07-16-2012

Thank you, I wanted to add the total count to the other fields that were in there and it doesnt seem to want to let me do that. it takes all the other fields away and just gives me a count total instead of adding to the chart that i already have.

Michael_Schyma1 · ‎07-16-2012

index=hik sourcetype="MainframeApps" | stats count as "Total Count" | append [search index=hik sourcetype="MainframeApps"| top limit=0 app_id app_name | app_id AS "App Code" app_name AS "Application Name" count AS "Number of Events" percent AS "Percent"]

Michael_Schyma1 · ‎07-16-2012

maybe i am just wording it wrong. I just want a total number of events and i can not get it. with your code i get search operation 'app' is unknown

Michael_Schyma1 · ‎07-16-2012

I was a total count field that will either display one number of all the events, or a running total that will display the total at the top instead of the bottom.

Michael_Schyma1 · ‎07-16-2012

I can not figure out how to get the sum of all the information at the top without changing the other fields around. I really just want a sum, but i can not seem to get the stats sum function to work. |top limit=0 app_id app_name | fields + count, total_count, percent,app_name, app_id | accum count AS total_count | rename total_count AS "Total Count" app_id AS "App Code" app_name AS "Application Name" count AS "Number of Events" percent AS "Percent" Any help would be appreciated, i am just not sure where to go from here i just need a total of all not necessarily a running total

Michael_Schyma1 · ‎07-16-2012

I also tried using the stats sum(count), but all i get is one field instead of everything else that I have in my chart.

Michael_Schyma1 · ‎07-16-2012

I just want the total count to come to the top and the rest of the fields stay the same.

Michael_Schyma1 · ‎07-16-2012

so your saying: top limit=0 app_id app_name | fields + count, total_count, percent,app_name, app_id | accum count AS total_count | reverse total_count because i cant seem to get this to work either

Michael_Schyma1 · ‎07-16-2012

.....|top limit=0 app_id app_name | fields + count, total_count, percent,app_name, app_id | accum count AS total_count Is there any way to get a running total to put the total at the top of the page instead of the bottom?

Michael_Schyma1 · ‎07-10-2012

sourcetype="MFApps" | addtotals fieldname=sum |top limit=1 sum | fields + count | rename count AS "Number of Events This is my search and all I want is one field that lists the total number of events. It does not seem to be keeping a sum of all events. Instead it just seems to be keeping the highest event number.

Michael_Schyma1 · ‎07-10-2012

Is there a way to use the top function that will list all of the fields (like setting it equal to infinity) that I am trying to list in my chart.

Michael_Schyma1 · ‎07-05-2012

Sorry about that, i am not sure how that got there.

Posts	131
Solutions	3
Karma Given	38
Karma Received	13
Member Since	‎07-05-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

total similar events

The PDF function sends as CSV

Two Events with the same sourcetype to NullQueue

Daily throughput of a particular index

Error when trying to clone a report [HTTP 404]

'AND' operator in Regular Expressions

Keep specific events and discard the rest

Regular expression help and error (Regex: unmatche...

Blocking messages because license is exceeded (Sid...

regular expression ( Alert)

Re: Generating a RegEx/ prop change doesnt work

Generating a RegEx/ prop change doesnt work

Search- Removed/Added

Re: Locked/Unlocked

Locked/Unlocked

Re: Not getting any data

Re: Not getting any data

Re: Not getting any data

Re: Not getting any data

Not getting any data

Stats sum function

Re: Reverse running total/ sum needed

Re: Reverse running total/ sum needed

Re: Reverse running total/ sum needed

Re: Reverse running total/ sum needed

Re: Reverse running total/ sum needed

Re: Reverse running total/ sum needed

Reverse running total/ sum needed

Re: Sum of running total at the top not bottom.

Re: Sum of running total at the top not bottom.

Re: Sum of running total at the top not bottom.

Sum of running total at the top not bottom.

Need a sum

Setting top limit to display all fields.

Re: Running Total

Join the Conversation