I have 2 Splunk SPLs ===================== index=computer_admin source=admin_priv sourcetype=prive:db account_name=admin earliest=-1d | fields comp_name,comp_role,account_name,local_gp,gp_name | table comp_name,comp_role,account_name,local_gp,gp_name ===================== The comp_name fields has values such as ,  AAAAA, BBBBB,  CCCCC, AFSGSH, GFDFDF, IUYTE, HGFDJ, ZZZZZ, YYYYYY, IIIIII, EEEEEE Basically I am looking for all the comp_names that the admin is on and copying the list to use in another SPL  to get the comp owners. Second SPL : =================== index=computer_admin  source=emp_card_details  sourcetype="something:db" C_NAME IN (AAAAA, BBBBB,  CCCCC, AFSGSH, GFDFDF, IUYTE, HGFDJ, ZZZZZ, YYYYYY, IIIIII, EEEEEE) | eval arl=lower(C_NAME) | stats values(asset_owner) by arl =================== Can we use subsearch or any thing similar to get it done in on SPL ? Any assistance ? ... View more

I have  this 'Email' Data Model in ES. The model is populated by macro and tags(2 eventypes populated by saved searches) (`cim_Email_indexes`) tag=IS_Email  The two eventtypes have IS_Email tag associated to them . Now,  A new source needs to be fed into the dataModel. The fields of the new source  are cim compatible but are not fed into the dataModel. And I checked the corresponding eventType and there were some tags associated to it but IS_Email tag wasn't there. So, To add the data from this new EventType into the datamodel, if I just add IS_Email tag into it(the eventtype), is it sufficient ? Or anything else is required ? If this is sufficient, then after adding the Tag, do I need to rebuild the Email DataModel  ? ... View more

My events are in json format. The  json path where my data is , is here   "alert.smtp-message.smtp-header" And with in "smtp-header", I have content like this,  from which I could use help in extracting some fields using rex. ============   "smtp-header": "Received: from mxdinx66.Gramyabnk.com (mxdinx66.Gramyabnk.com [159.45.78.215])\n\tby mn-svdc-epi-ran11.ist.Gramyabnk.net (Postfix) with ESMTP id 4JyJsN6m8kzVKnNg\n\tfor <[email protected]>; Mon, 14 Feb 2922 22:66:28 +9999 (UTC)\nReceived: from pps.filterd (mxdinx66.Gramyabnk.com [127.9.9.1])\n\tby mxdinx66.Gramyabnk.com (8.16.9.42/8.16.9.42) with SMTP id 21EMIuas425197\n\tfor <[email protected]>; Mon, 14 Feb 2922 22:66:28 GMT\nReceived: from mx9a-99994996.pphosted.com (mx9a-99994996.pphosted.com [295.229.165.191])\n\tby mxdinx66.Gramyabnk.com with ESMTP id 6e65wvawac-1\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA684 bits=256 verify=NOT)\n\tfor <[email protected]>; Mon, 14 Feb 2922 22:66:27 +9999\nReceived: from pps.filterd (m9216616.ppops.net [127.9.9.1])\n\tby mx9b-99994996.pphosted.com (8.16.1.2/8.16.1.2) with ESMTP id 21EIDxq8928666\n\tfor <[email protected]>; Mon, 14 Feb 2922 22:66:26 GMT\nAuthentication-Results: ppops.net;\n\tspf=pass [email protected];\n\tdkim=pass header.d=efk.admin.ch header.s=dkimkey1;\n\tdmarc=pass header.from=efk.admin.ch\nReceived: from mail11.admin.ch (mail11.admin.ch [162.26.62.11])\n\tby mx9b-99994996.pphosted.com (PPS) with ESMTPS id 6e625qnsf9-1\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA684 bits=256 verify=NOT)\n\tfor <[email protected]>; Mon, 14 Feb 2922 22:66:26 +9999\nDKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=efk.admin.ch; h=to\n\t:subject:date:to:from:reply-to:subject:message-id:mime-version\n\t:content-type:content-transfer-encoding; s=dkimkey1; bh=uoC6bt5q\n\thKVezRrk1ux9j7rGCMvkx/6cA9/rS1xbvwE=; b=V9mOEgc1tAyvbFpvkKFgHbnD\n\tHDh67iweoPEV7ZYCPpLW8KSBRU+uX+uL64xdJu9E1mp+BvITob98PRfIaCSIi6HC\n\tIf74+dtpxcVyfo9JXZmCj49tJdilXquYWoCu+OhLeONYd9/NMVs4S/IFHnYT/hmN\n\tNBzuP/5C6MKdlHavIwo=\nTo: \"Pretty Eloisa send you naughty videos https://vk.cc/cb5mIY\" <[email protected]>\nSubject: =?utf-8?Q?Pretty_Eloisa_send_you_naughty_videos_https://vk.cc/cb5mIY,_bitte?= =?utf-8?Q?_best=C6=A4tigen_Sie_ihre_EFK-Newsletter-Anmeldung?=\nDate: Mon, 14 Feb 2922 22:61:28 +9999\nTo: \"Pretty Eloisa send you naughty videos https://vk.cc/cb5mIY\" <[email protected]>\nFrom: \"Eidg. Finanzkontrolle\" <[email protected]>\nReply-To: \"Eidg. Finanzkontrolle\" <[email protected]>\nSubject: =?utf-8?Q?Pretty_Eloisa_send_you_naughty_videos_https://vk.cc/cb5mIY,_bitte?=\n =?utf-8?Q?_best=C6=A4tigen_Sie_ihre_EFK-Newsletter-Anmeldung?=\nMessage-ID: <[email protected]>\nContent-Type: multipart/alternative;\n\tboundary=\"b1_292f6ee91b9de8a92268de4c4ce5b57f\"\nX-TM-AS-GCONF: 99\nX-MSH-Id: E7195F2B6F624BA184EA6D9F12CD98AE\nContent-Transfer-Encoding: 7bit\nX-Proofpoint-GUID: 5sQWXU-CRjHoWtaxmd54Yn68A2IDf2Eu\nX-CLX-Shades: MLX\nX-Proofpoint-ORIG-GUID: 5sQWXU-CRjHoWtaxmd54Yn68A2IDf2Eu\nX-CLX-Response: 1TFkXGxgaEQpMehcaEQpZRBd6GF1SX9ZiBWNEcxEKWFgXbGdhYnBoGkBpaxo 7GxAHGRoRCnBsF6oeXwEBQkZDfXBTEAc ZGhEKcEwXZ1MfZ6t5RRkTE9AQGhEKbX4XGhEKWE9XSxEg\nMIME-Version: 1.9\nX-Brightmail-Tracker: True\nx-env-sender: [email protected]\nX-Proofpoint-Virus-Version: vendor=nai engine=6699 definitions=19258 signatures=676461\nX-Proofpoint-Spam-Details: rule=inbound_aggressive_notspam policy=inbound_aggressive score=9\n clxscore=129 suspectscore=9 adultscore=9 bulkscore=9 mlxlogscore=472\n malwarescore=9 phishscore=9 spamscore=9 priorityscore=9 lowpriorityscore=9\n impostorscore=9 mlxscore=9 classifier=spam adjust=9 reason=mlx scancount=1\n engine=8.12.9-2291119999 definitions=main-2292149128",     ============================================== I just need the extraction of the fields present in the last 3 lines in bold. The values after the = sign , excluding the \n . clxscore suspectscore adultscore bulkscore mlgxscore malwarescore phishscore spamscore priorityscore owpriorityscore  impostorscore mlxscore classifier ... View more

I have, sourcetype_A  (fields : ID, age, city, state) sourcetype_B  (fields : ID, job, salary, gender) The fields "ID" is common in both sourcetype_A and B but with a caveat. example1 : for ID = 1687, it is present in sourcetype_A as 0001687 , in sourcetype_B as 1687 example2 : for ID = 9843, it is present in sourcetype_A as 009843 , in sourcetype_B as 9843 example3 : for ID = 8765, it is present in sourcetype_A as 08765 , in sourcetype_B as 8765 where 1687, 9843, 8765 are the actual IDs. zeros are creating mess in sourcetype_A . I am not allowed to use join, So this is what I am trying but I am not seeing all my data. =================================== (index=country) sourcetype=sourcetype_A OR sourcetype=sourcetype_B | eval ID = ltrim(ID,"0") | eventstats dc(sourcetype) as dc_st | where dc_st >1 | table ID, age, city, state,  job, salary, gender =================================== I also tried | stats values (age) as age                                  ........      ..........................................................                   by ID. But stats gave me massive multivalue fields with messy duplicates. I am asked to get in one row per data (no multivalues ) Any help ? ... View more

There is a SPL search, ending with stats that generates 300 events. Now that Search, lets call it "SEARCH-1" is saved as a 'saved search', and in the 'saved-search' one extra line is added, i.e. | collect index=sec_apps_summary source="savedSearch_1d" And earliest , latest setting as -1@d and @d  . There is another SEARCH-2, that invokes the 'saved search' and the SPL starts like, | index=sec_apps_summary source="savedSearch_1d" .... What confuses me is, SEARCH-1 and SEARCH-2 should show same count of result, but I see 300 events for SEARCH-1 and very less 16 events for SEARCH-2. I suspect something about the way the 'saved search' is utilized , I quite don't understand the difference in result.  Any idea , why ? ... View more

my tablular output contains columns/fields like, account_number | colour | team_name |  business_unit I am getting the above output by stats aggregating BY 'account_number'. Some of the events with the same account_number has null (colour,  team_name and  business_unit) values. So I used , | streamstats last(colour) as colour, last(team_name ) as team_name , last(team_name ) as team_name . to populate from the previous row values. I want streamstats to populate the empty fields with the previous row value, "ONLY IF, the previous row "account_number" is same with the current row".   The issue I am getting now is, lets say. I have three rows with account_number value 0001. and if 4th row has account_number is 0002 and has other three fields (colour,  team_name and  business_unit) empty, it is populating them with the previous 0001 account_number's value , which is incorrect.  ... View more

I have this query where I need to use stats to aggregate the results based on account_number.   Now, some of the results are multivalued. I need the output to be like a table, one values for each row.  like somehow expand the aggregated results into a tabular  format. ========================================= `index_list` account_type="Service Account" | addinfo | eventstats dc(sourcetype) as dc_sourcetype by service_number | where dc_sourcetype>1 | stats values(is_interactive) as is_interactive, values(account_name) as account_name, values(full_name) as full_name, values(email_address) as email_address, values(manager_name) as manager_name, values(service_account_name) as service_account_name, values(account_type) as account_type, values(service_account_id) as service_account_id, values(au_owner_name) as au_owner_name, values(au_owner_email) as au_owner_email BY account_number ======================================= account_type, service_account_id, account_number are multivalue fields. ... View more