I have a rather large lookup table of IP addresses and domain names. I keep adding to this list as we get advisories from various groups. The list has gotten so large that I forget what some of them were for, so I have begun to place (in comma delimited form) referring group (aka FBI, SANS, etc.) and what type of attack it is a part of (pony, struts2, etc.). My lookup table works fine, but how do I get the other two entries to be included when I get a hit on an address? Here is what I have: index="firewall" dst_ip OR scr_ip( [|inputlookup bad_actors.csv|rename host as query | fields query] ) NOT www.google.com *the NOT www.google.com is my sanity checker I put in my tables to make sure things are working correctly. Obviously the search is going to bring up any hits I may get and I can obviously put it into to a report, but I need to know how to get the second and third fields in there to make it useful. Thanks for looking! ... View more

I have the search: index="weblogs" filter_result!="-" useragent="* (compatible; MSIE 10.6; )" OR useragent=" (compatible; MSIE 10.0; )" OR useragent=" (compatible; MSIE 9.0; )" OR useragent=" (compatible; MSIE 8.0; )" OR useragent=" (compatible; MSIE 7.0b; )" OR useragent=" (compatible; MSIE 7.0; )" OR useragent=" (compatible; MSIE 6.1; )" OR useragent=" (compatible; MSIE 6.01; )" OR useragent=" (compatible; MSIE 6.0b; ) OR useragent=" (compatible; MSIE 6.0; *)" | top limit=10000 useragent What I need is to get every event under each useragent string to show up as a combined total for each type (MSIE 10.6) would be the total count of every variation that had MSIE 10.6 in its useragent string...and the same thing for MSIE 10.0, etc, etc, etc.. There will be more browser types in there once I get this working. Ultimately, I am trying to create a pie chart, for a dashboard, that will show all the browser types (or the top 20) that view our sites. I am not interested in any apps at this time. Thanks for the help! ... View more

Looking at all the posts regarding User-Agent HTTP header searches, one of the commonalities is that they were told to change their format to Combined Log Format. I unfortunately cannot do that but I am still being asked to create a dashboard reports to show most common OS used and most common browser. Here is a log: XX.XX.XX.XX - - [30/Jul/2013:15:16:40 -0700] 0 "GET /portal-web/images/denied.png HTTP/1.1" 200 882 "htps://ABC.ABC.com/portal-web/stuff/stuff.action" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)" Ultimately I want separate count columns for browser type and OS type. How do I go about extracting the info I want? I believe I need to use a Regex statement, but I am unsure on how to proceed especially since both the client and browser are going to change in size? ... View more

I am trying to take a saved search, with a large ammount of keywords and make the saved search smaller and more versitile by using a lookup table. Here is the current search (it is a sensitive word search based on what search engine is used): index="bcproxy" sourcetype="bcoat_proxysg" dest_host="www.google.com" (nude OR nudity OR naked OR milf OR bondage OR porn OR nsfw OR bikini OR erotic OR eros OR xxx OR ecstacy OR softcore OR hardcore OR sex OR sexy OR flashing OR amatuer OR topless) | top Google_Searches,user limit=20 showcount=0 showperc=0 | rename user as Google_User | appendcols [search dest_host="search.yahoo.com" (nude OR nudity OR naked OR milf OR bondage OR porn OR nsfw OR bikini OR erotic OR eros OR xxx OR ecstacy OR softcore OR hardcore OR sex OR sexy OR flashing OR amatuer OR topless) | top Yahoo_Searches,user limit=20 showcount=0 showperc=0 | rename user as Yahoo_User] | appendcols [search dest_host="www.bing.com" (nude OR nudity OR naked OR milf OR bondage OR porn OR nsfw OR bikini OR erotic OR eros OR xxx OR ecstacy OR softcore OR hardcore OR sex OR sexy OR flashing OR amatuer OR topless) | top Bing_Searches,user limit=20 showcount=0 showperc=0 | rename user as Bing_User] As you can see, this is a rather large search (I took out other keywords). This is what I am trying to do but it is not giving me any results: index="bcproxy" sourcetype="bcoat_proxysg" (dest_host="www.google.com" ([|inputlookup keyword]) ) | top Google_Searches,user limit=20 showcount=0 showperc=0 | rename user as Google_User I am just trying to make the first part work and then I figured it would be easy to add the other parts. I do have the csv loaded into Splunk and the lookup definition created. Any suggestions on getting this to run properly would be greatly appreciated. Here is the debug for the shortend query: did not return any data. Possible solutions are to: •relax the primary search criteria •widen the time range of the search •check that the default search indexes for your account include the desired indexes The following messages were returned by the search subsystem: DEBUG: Subsearch evaluated to the following search expression: ( ( keyword="nude" ) OR ( keyword="nudity" ) OR ( keyword="porn" ) OR ( keyword="nsfw" ) OR ( keyword="bikini" ) OR ( keyword="erotic" ) OR ( keyword="eros" ) OR ( keyword="xxx" ) OR ( keyword="ecstacy" ) OR ( keyword="softcore" ) OR ( keyword="hardcore" ) OR ( keyword="sex" ) OR ( keyword="sexy" ) OR ( keyword="flashing" ) OR ( keyword="amatuer" ) OR ( keyword="topless" ) ) DEBUG: [SRV-SI001] search context: user="joeuser", app="searchdev", bs-pathname="H:\Splunk\var\run\searchpeers\SRV-SS001-1372108101" DEBUG: [SRV-SI002] search context: user="joeuser", app="searchdev", bs-pathname="H:\Splunk\var\run\searchpeers\SRV-SS001-1372108101" DEBUG: [SRV-SI001] search context: user="joeuser", app="searchdev", bs-pathname="H:\Splunk\var\run\searchpeers\SRV-SS001-1372108101" DEBUG: [SRV-SI002] search context: user="joeuser", app="searchdev", bs-pathname="H:\Splunk\var\run\searchpeers\SRV-SS001-1372108101" DEBUG: [subsearch]: Successfully read lookup file 'H:\Splunk\etc\apps\searchdev\lookups\porn_keywords.csv'. DEBUG: base lispy: [ AND com google index::bcproxy sourcetype::bcoat_proxysg www [ OR amatuer bikini ecstacy eros erotic flashing hardcore nsfw nude nudity porn sex sexy softcore topless xxx ] ] DEBUG: search context: user="joeuser", app="searchdev", bs-pathname="H:\Splunk\etc" ... View more