I am looking for a way to compare an hourly ave(count) with the All time historic average. Below is a sample query provided by FrankVl. index=some_db sourcetype=syslog_transactions |bin _time span=1h | stats count as hourly_count by USER, _time | sort _time | streamstats avg(hourly_count) as historic_avg by USER This works fine for last 24 hours; but now I want to look at the last 24 hours "hourly_count" and compare it to an 'All time' running ave(hourly_count). My overall objective is to create a behavioral detection where I can also set a threshold to see when transactions spike up. For example, if user X has a normal range of transactions every hour (between 0-100/hr) and suddenly user X jumps up 10x the normal like 1k transactions/hr, then I want to be able to find this based on a calculation against the normal average for all time. And then I want to exclude the hourly_counts that are abnormal (like 1000/hr vs 10/hr , 10/hr being normal) from the 'All time' average. I reworked the above query and I can change the WHERE statement. But I feel like I am reinventing a wheel, as I am sure someone has probably needed a similar solution. index=some_db sourcetype=syslog_transactions |bin _time span=1h | stats count as hourly_count by USER, _time | sort _time | streamstats avg(hourly_count) sum(hourly_count) by USER | WHERE hourly_count > (10*hourly_avg) Please advise if there is a better way to do this. Thank you ... View more

Hi I am trying to write a query where I can monitor transactions/hr/user. I would like an output where I have the hourly count and historic hourly average. I started with this, for past 24 hours, to look for users above a 10000 events per hour ... index=some_db sourcetype=syslog_tranactions |bin _time span=1h | stats count by created_by | WHERE count > 10000 But now I was asked to get a baseline of average transactions per hour per user as a running average as a separate output column Something like this: User, Hourly Count, Historic Ave Jon, 125, 140 I am hoping someone could point me in the right direction as I peruse the documentation. Thank you ... View more

Hi, I have been tinkering with regex101 for some time now and no luck. I have a field called sender Return-Path:<[email protected]> Return-Path:<[email protected]> I want to regex the sender so that I get someDomain.com someDomain.com.blah So I want the string to start after @ and end before > here is what I started with ... | rex field=sender "@(?<domain>.*)" Thank you ... View more

I have a list of userIDs on a text file, called WatchList.txt Splunk can natively parse out a field value pair (userID = John) from the logs I am searching. My list is as follows: userID John Mary Bob Paul I want write a query like this: index=app_logs sourcetype=user_logs | stats count by userID | WHERE (userID is on the list) I am not sure how to write it, or how I can use a lookup as an input to the search. index=app_logs sourcetype=user_logs [| inputlookup WatchList.txt] | stats count by userID Is this correct ??? Or is there a better way??? Please provide an example. Thank you ... View more

I have an app behind a WAF, and I am looking at the WAF logs to see how many unique login IDs are coming from a single sourceIP. so far I have index=WAF sourcetype=waf_log passed AND login | stats values(login_id) by sourceIP Before the pipe "passed" and "login" criteria provide me with all interesting logs that contain a login_id and a sourceIP. The challenge is finding the best way to list all IP(s) associated with a login_id, OR all the login_ids associated with a sourceIP, for the last 30 days. Is there a better way to write this? Ideally, I would like to create an alert if there are more than 5 login_id(s) associated to any unique sourceIP. Thank you ... View more

Anyone know why I keep getting this error when I try to upgrade the snow TA? An error occurred while installing the app: 500 ... View more

I have some URL encoded logs. ...| eval decoded_raw = urldecode(_raw) how would I write a rex to find any decoded_raw values containing "error", is it possible to pass the urldecoded field into a regex? or can you regex the eval-ed / decoded field? Thank you ... View more