×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
dangerusty
Engager
Member since: ‎03-07-2018
‎06-05-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎03-07-2018
Activity Feed
View All

How to extract field name containing square bracke...

by in Splunk Search
‎03-09-2018 09:04 AM
‎03-09-2018 09:04 AM
I have an auto-extracted field name of "conn" (conn=12345), but if the connection is SSL, then the field name becomes "conn[SSL/TLS]". I'd like to use that field name while doing things like transaction, but i cant find any way to get around those square brackets. I've tried double quotes, single quotes, dollar signs, renaming it to "conn", field alias to "conn", escaping the brackets. I assume I need rex, but I don't know where to start. Ideally I'd like a search of "conn=12345" to include both field names (conn & conn[SSL/TLS] as if they were one, but I'd settle for a successful rename (conn=12345 OR connSSLTLS=12345). ... View more

Re: How do I string certain searches together to g...

by in Splunk Search
‎03-07-2018 01:00 PM
‎03-07-2018 01:00 PM
Sourcetype="ldap" "filter=\"(id=1)\"" [07/Mar/2018:14:01:11 -0600] - OPERATION - INFO - conn=12345 op=123 msgid=456 SEARCH base="example.com" scope=2 controls="" filter="(id=1)" attrs="*" Sourcetype="ldap" conn=12345 client [07/Mar/2018:14:00:37 -0600] - CONNECT - INFO - conn=12345 client=10.0.0.2:56789 Sourcetype="loadbalancer" "10.0.0.2|56789" Client_Acpt | Wed Mar 07 2018 14:00:37 | 10.0.0.5|56789| VIP | 10.0.0.4|636 | SNAT_IP | 10.0.0.2|56789 | Node | 10.0.0.3|636 I want a list of user IP addresses (such as 10.0.0.5 in this case) that searched with filter="(id=1)". ... View more

How do I string certain searches together to get a...

by in Splunk Search
‎03-07-2018 11:18 AM
‎03-07-2018 11:18 AM
I have connection logs for a database. I need to identify users making certain queries. I'd like to: Search for a string identifying the query Check that whole transaction for the original "open connection" event to get the IP address The IP address is a load balancer, so I have to check that IP/port in the load balancer logs to get the actual user IP address How do I string these searches together to get a list of user IP addresses doing a particular query? I suspect the "transaction" command is key here, but I haven't found a clue in the examples. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma given to
View All