Hi All,  I need to filter my search based on the condition if the values of 2 fields are equal or not.  The 2 fields in question are actor.alernateID  and src_user_email and both fields are visible in the same event. For example:  Raw data shows value of actor.alternateID is   [email protected]   neerajs_81_0-1648619765791.png Likewise, Raw data shows value or src_user_email is also same:  [email protected] neerajs_81_1-1648619923583.png If i run the following search,  the value of the field match  comes out to be "No match" .  Why is eval showing them to be not a match if both field values are the same ?      index=xxx sourcetype=xxxx .... | eval match=if(actor.alternateId=src_user_email,"Match","No Match")       neerajs_81_3-1648620163158.png Likewise, instead  if i  use the where condition instead of eval  ,  this shows NO results to display;   meaning  even the where clause thinks both fields are different .       |where src_user_email = actor.alternateID     The same is happening for other email IDs and other fields even though their values are same. What am i doing wrong here? How to compare fields then?  Both are strings. ... View more

Hi, how do i craft a search to match 2 fields from my raw events with  2 fields from a CSV file and output if one of the fields is different  ?  Requirement is to match the country_name and email from raw events versus to what is there in the csv file.  Basically If the country_name in the raw events in DIFFERENT as in if it does not match the "Country" field in the lookup (based on user's email) then display those results only.   Lookup file structure: Email_id Country         The Raw events have fields called email and country_name. Below is what i am trying but its not working.       index=xxx | search [inputlookup file.csv ] where (country_name != Country) AND (Email!=Email_id) table displayName, Email_id country_name         ... View more

Gentlemen, We are ingesting Windows SYSmon logs via TA-microsoft-sysmon , and the raw events are showing in XML format.   There are couple of fields that did not get extracted and even with IFX, the accuracy of extracting these 2 fields isn't working 100%.   Below is one of the XML tags / elements from my raw event.  Can someone pls assist me with regex for extracting  techqniue_id and technique_name ??   As you can see, these 2 are embedded within the "RuleName" tag.       <Data Name='RuleName'>technique_id=T1055.001,technique_name=Dynamic-link Library</Data>       I have tried on regex101.com but can't get my capture group to extract these 2 values.  At the end of the day, i want 2 fields  techqniue_id ( with a value=T1055.001)   and technique_name ( value = Dynamic-link Library) to show up under "Interesting fields" . Thank you in advance ... View more

Gentlemen, We are using  https://splunkbase.splunk.com/app/1914/  Splunk is not extracting all the fields visible in the Windows Sysmon events. It leaves out lot of fields.    This is what i suspect is the cause, but need someone to advise if i am on the right track. In the events, the SourceType shows as: WinEventLog:Microsoft-Windows-Sysmon/Operational   However, On my Search Head when i go to Settings >> SourceTypes >> ALL , i see a different name:   XmlWinEventLog:Microsoft-Windows-Sysmon/Operational There is no source type here by the name of WinEventLog:Microsoft-Windows-Sysmon/Operational   Is the conflict of different sourcetype names causing the issue ?  What needs to be done to fix ? Things i tried... 1.  Added the following in inputs.conf to make it format as per XML   [WinEventLog://Microsoft-Windows-Sysmon/Operational] renderXML=true sourcetype=XMLWinEventLog:Microsoft-Windows-Sysmon/Operational   This did extract all the fields but ended up showing the  events in XML format .  How can i keep the default /original format of displaying Windows events yet make it extract all the fields ? Thanks all ... View more

Gentlemen,  Need some help with lookup command.  i have a lookup table (csv) which is a master list of user accounts. It looks something like this. user_id first last email phone manager             I have a Scheduled search that runs daily . This search  shows only the users that been modified , updated or newly created . How can i append the results of this search to my above csv lookup file in such a way that it does not create duplicates ?   Basically  if the user record already exits in the csv and if the search finds one of his attributes has been updated ( for example: manager ),  then the outlookup should update the existing user record  in the csv rather than creating a duplicate one.  Hope i am clear. I read some posts about users recommending   to use the below command, but don't understand how does appending solve this use case ?  Should i be using this ?   | append [inputlookup <lookup_csv>]   The "Scheduled Search"  is configured to "append"  to the csv lookup in its properties.   neerajs_81_0-1647273464625.png   Thanks in advance ... View more

Gentlemen, How can i use eval  to assign a field  values of 2 different fields ? In my events, i have 2 fields:  empID and Non-empID .  I want eval to create a new field called identity  and this should have the value of either empID OR Non-empID whichever is present .  Hope i am clear I tried       eval identity = coalesce (empID , Non-empID )        but this didn't work. Any  suggestions ?  Any other way to get this done if eval doesn't do it ? Eventually i am going to have a table as follows, and the Identity column should consolidate empID / Non-empID whichever is present for that employee record. identity First Last email Emp ID       Non-Emp ID         ... View more

Hello All,    One of our indexes ( Name: okta ) has a searchable retention period of 90days as shown in the screenshot. Is there a way to pull data earlier than the 90 day mark ? We want to go back upto last 1 year.    If i change this value to 365 days will it me search thru the old data ( older than 90d ) ? OR is there something more that needs to be done.. ? Thanks in advance neerajs_81_0-1646811111612.png     ... View more

Hi All, In ES or in Splunk in general ,   How to return field value in double quotes ?   We have the below setting for "Drill Down Name"  which displays the Policy Name when alert is triggered.  I did like the Policy Name to be enclosed in double quotes when it displays in the alert though.  Any suggestions ? neerajs_81_0-1646725930137.png Should i try this ?   \"$policy_name$\"     ... View more

Hello All, how can we search against 2 columns of a CSV lookup file and if the value of the field that i am searching for happens to be either of the 2 columns, then exclude those results ? Kind of a whitelist. Lets say i have a csv table of 2 columns as follows URLs UA         i am searching against my firewall logs and if the url field in the events matches  against URLs column of the table  OR the user_agent field from events matches the UA column of the table, then exclude those events This is what i have come up with but its not working...     index= firewall NOT [ | inputlookup lookup_file.csv | rename url as URLs | fields url] OR NOT [ |inputlookup lookup_file.csv | rename user_agent as UA | fields user_agent] .......       ... View more