About pierre_weg

pierre_weg · ‎07-24-2023

Hi guys! I have a static snapshot lookup that stores a lot of information about vulnerabilities actives on my hosts in mar/01. This SPL shows me a full list of the unique identifiers. | inputlookup gvul:collectMar.csv | table UniqID This SPL shows me a list of the unique identifiers actives today earlyest=-1d index=myindex sourcetype=mysourcetype | table UniqID My team works to fix this vulnerabilities, so I want a timechart to show the work progress, based on the snapshot lookup. I don care about new vulnerabilities since the snapshot. This is the SPL that I'm using to do this. earliest=1677719215 index=myindex sourcetype=mysourcetype | join type=inner UniqID [ | inputlookup gvul:collectMar.csv | table UniqID] | timechart span=1d count(UniqID) So, is there a way to do this but not using a join statement?

pierre_weg · ‎03-24-2023

I found the mistake... It was a syntax error The right way is | fillnull value="FIX" BIA not | fillnull BIA value="FIX" Thanks again!

pierre_weg · ‎03-23-2023

Hi @bowesmana I found an issue... In sourcetype=cmdb the all events have the field BIA with "H", "M" ou "L" values. After the join, and using "fillnull", if I use "fillnull BIA value="E"", 100% of the events have one of the 4 values, but if I use "fillnull BIA value="H"" 100% of the events will have "H" value. what I'ḿ doing wrong?

pierre_weg · ‎03-23-2023

Hi guys! I have a dashboard with a text input that are connected with a token ($tk1$) , and a "Submit" button. What I want is, when click on Submit, to read the typed text on the input, and run a | table... | collect... Here is my dashboard code: <form version="1.1"> <label>LAB2</label> <fieldset submitButton="true" autoRun="false"> <input type="text" token="tk3"> <label>Comments</label> </input> </fieldset> <row> <panel> <table> <search> <query>index=lab sourcetype=lab2 A=$TK1$ B=$TK2$ | eval C="$tk3$" | table A B C</query> </search> </table> </panel> </row> </form>

pierre_weg · ‎03-14-2023

Great! Great! Great! @bowesmana Thanks for your help!

pierre_weg · ‎03-13-2023

Hello fellows! I have a sourcetype called cmdb with a field called BIA to any src_host. After this join index=lab sourcetype=A | join type=left src_host [search index=lab sourcetype=cmdb] Most of the src_host now figures with the BIA field, but some of them don't. It's OK, because they do not exist on cmdb sourcetype. I want to fix the value of the BIA field for this hosts. I try to use a lot of tings like... | eval BIA = if( len(BIA)==0, "FIX", BIA) but is not running fine. Can someone help me?

pierre_weg · ‎03-13-2023

Thanks @PickleRick I found a solution that seem to retrieve what I need just doing this index=lab sourcetype=A | eval XPTO=if([ search index=lab sourcetype=B | fields IP],"yes","no")

pierre_weg · ‎03-13-2023

Hi guys! I have a sourcetype "A" with some info about infrastructure. Host IP is one of this info. I have another sourcetype "B" (same index) that have a list of critical IPs. What I'm trying to do is to use eval and IF to set a field value if the IP from sourcetype "A" are present on sourcetype "B". Fixing the IP value on the subsearch, the result is correct. index=lab | eval XPTO=if([ search index=lab sourcetype=B IP="192.168.1.2"],1,0) but I need to pass the IP dynamically from the main search. Something like... index=lab | eval XPTO=if([ search index=lab sourcetype=B IP=$IP$],1,0) it's a simple question, like an Excel VLOOKUP function. Did you have a suggestion?

pierre_weg · ‎06-27-2018

Great! Thank you FrankVI.

pierre_weg · ‎06-27-2018

Hi all! I have a table as a search result: date Country cs_username 2018-06-12 Mexico mendoza 2018-06-12 Mexico mendoza 2018-06-12 Mexico mendoza 2018-06-14 Mexico mendoza 2018-06-20 Mexico mendoza 2018-06-22 Mexico mendoza 2018-06-25 Mexico mendoza 2018-06-26 Mexico mendoza 2018-06-26 Mexico mendoza 2018-06-11 Netherlands xing 2018-06-11 United States xing 2018-06-11 Nigeria xing 2018-06-13 United States xing 2018-06-14 United States xing 2018-06-15 United States xing 2018-06-17 United States xing 2018-06-22 Brazil xing 2018-06-24 United States xing 2018-06-25 Brazil xing 2018-06-25 Brazil xing 2018-06-25 United States xing 2018-06-17 China xue 2018-06-18 China xue 2018-06-20 China xue 2018-06-21 China xue 2018-06-22 China xue 2018-06-22 China xue 2018-06-22 Brazil xue Note that to the same days I have the same user and 2 different Countries. 2018-06-11 xing 2018-06-25 xing 2018-06-22 xue This is the condition that I have interest. I need to filter the table results to show just this: 2018-06-11 Netherlands xing 2018-06-11 United States xing 2018-06-11 Nigeria xing 2018-06-25 Brazil xing 2018-06-25 Brazil xing 2018-06-25 United States xing 2018-06-22 China xue 2018-06-22 China xue 2018-06-22 Brazil xue Can anyone help me? Thanks a lot!

pierre_weg · ‎12-09-2015

I look the Oracle log files (alert.log) and network (listener.log) but no errors was found at the connection moment.

pierre_weg · ‎12-08-2015

It's an Oracle 12c database, but I will check the logs and come back with the news.

pierre_weg · ‎12-08-2015

Hi all! I'm trying to set up the Splunk DB Connect 2 App. I have a valid user that can make a select operation on a particular table, tested via SQL directly. If I try the same query using the "Query" tab on my Connection, using "Advanced query mode" the App returns: External search command 'dbxquery' returned error code 1. Script output = " ERROR "Exception at ""/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.py"", line 123 : No rpc server enabled" " Can anyone help me?

pierre_weg · ‎05-25-2015

I get my answer opening a support case. You can add max_match to the rex. For example, |rex field=_raw "File: (?.+)"| rex "Subject: (?.+)"| rex "Sender: (?.+)"| rex "Recipient: (?.+)"| rex "To: (?.+)" max_match=3| rex "Cc: (?.+)"| rex "Exchange-AuthAs: (?.+)"| rex "originalclientipaddress: (?.+)"| rex "Size: (?.+)"| rex "Content-Disposition: (?.+)"| rex "Bcc: (?.+)" In order to capture all the fields that had multiple values (such as the To: and Cc: fields), I set the following up: props.conf: [test-240026] REPORT-logextracts = extractions Then in transforms.conf I had the following: [extractions] REGEX=([^:]+):([^\r\n]+) FORMAT=$1::$2 MV_ADD = true That worked good...except for the first line of the entries which was the date/time stamp. It made a field named "Tue, 19 May 2015 13" with a value of "47:05 +0000" - which isn't really what we wanted. So I added a sedcmd to modify the date line as it got indexed. I changed it from "Tue, 19 May 2015 13:40:43 +0000" to "Timestamp: Tue, 19 May 2015 13:40:43 +0000". So, now it'll extract a field called "Timestamp" with a value of "Tue, 19 May 2015 13:40:43 +0000". So now that we got that working, we can turn on MV_ADD=true in the transforms.conf. That'll take any other matches it finds and make a multi-value for it. So if it encounters multiple To: values in one event, it'll collect them all. Here's the full props.conf: [test-240026] REPORT-logextracts = extractions SEDCMD-fixdateline = s/(^[\w]{3},\s+[\d]{2}\s+[\w]{3}\s+[\d]{4}\s[\d]{2}:[\d]{2}:[\d]{2}\s+[\d]{4})/Timestamp: \1/g Transforms.conf: [extractions] REGEX=([^:]+):([^\r\n]+) FORMAT=$1::$2 MV_ADD = true Thanks Brian for the support.

pierre_weg · ‎05-19-2015

thanks by the effort

pierre_weg · ‎05-19-2015

pierre_weg · ‎05-18-2015

No way... 😞 I try using "SHOULD_LINEMERGE = true" and "BREAK_ONLY_BEFORE = ^$" to, but not working.

pierre_weg · ‎05-18-2015

props.conf [MailHeader] NO_BINARY_CHECK = 1 pulldown_type = 1 CHECK_FOR_HEADER = false REPORT-AutoHeader = MailHeader Nothing on Transforms.conf

pierre_weg · ‎05-18-2015

Sure, but Splunk is not doing the work.

pierre_weg · ‎05-18-2015

Yes, the fields Cc To and Bcc are optional. Just one of them are necessary and I can found more than one of them on a log entry. Splunk do this extraction when indexing Windows Eventlog, but I can't found the way (yet).

pierre_weg · ‎05-18-2015

Hi All! Today I index a log created from a script that extract some interesting fields from each received (from journaling) mail. This is a CSV log with the interesting fields and their contents separated by ";". I have some issues to work - Ex. a ";" character on the subject. I was looking for a less expensive and more elegant way to do this. I found a less expensive way to export the interesting fields, but it's a multiline log. Here is a piece of the log: Mon, 18 May 2015 17:57:13 +0000 File: /email/1431971833.Vfd04I741e37M920326.lab Sender: andresn@lab.com Subject: Proceed to Gate To: bhubnr@lab.com To: ilsonn@lab.com Cc: clasr@conf.com Bcc: WLI_GRP@lab.com Exchange-AuthAs: Internal originalclientipaddress: 192.168.115.10 Size: 10246 Content-Disposition: False Mon, 18 May 2015 17:57:02 +0000 File: /email/1431971822.Vfd04I74069fM442554.lab Sender: paulaugust@lab.com Subject: Follow up Marine. To: awelter@lab.com To: fpacker@info.com Bcc: WADVENConfCall01@lab.com Exchange-AuthAs: Internal originalclientipaddress: 192.168.71.61 Size: 193022 Content-Disposition: True Im trying to extract the fields using "rex" but still not running. After found the right regular expression I will add it on transforms.conf The follow expression is OK using the "Extract New Fields" functionality but not on the search: rex field=_raw "File: (?<FILE>.+) Subject: (?<SUBJECT>.+) Sender: (?<SENDER>.+) Recipient: (?<RCPT>.+) To: (?<TO>.+) Cc: (?<CC>.+) Exchange-AuthAs: (?<AUTH>.+) originalclientipaddress: (?<IP>.+) Size: (?<SIZE>.+) Content-Disposition: (?<ATTACH>.+) Bcc: (?<BCC>.+)" Can anyone help me please?

pierre_weg · ‎05-13-2015

Great! DELIMS do not work, but REGEX works very fine. Thanks a lot

pierre_weg · ‎05-13-2015

I set my props as follow: [mailheader] NO_BINARY_CHECK = 1 pulldown_type = 1 CHECK_FOR_HEADER = false REPORT-AutoHeader = MailHeader and my transforms as follow: [MailHeader] DELIMS="\1f" FIELDS="FILENAME","TIMESTAMP","IP","FROM","RETURN_PATH","TO","CC","SUBJECT","AUTH" Is not running... 😞 The fields aro not correctly separated.

pierre_weg · ‎05-12-2015

Hi all! A have a log file that use ASCII Dec 031 (US - Unit Separator) as delimiter. How can I configure my transforms and props to work with this delimiter? Thanks a lot.

pierre_weg · ‎10-24-2013

Same error... I have a log file with this content: 2013/10/04 15:40:05;PC301359;drussef;HEW2.exe;CFW70x_v12x - High-performance Embedded Workshop - [SoftPlc.c];,explorer.exe,HEW2.exe,bacbeat.exe,bacbeat.exe,bacbeat.exe,explorer.exe,sidebar.exe,sidebar.exe,explorer.exe,explorer.exe,OUTLOOK.EXE,OUTLOOK.EXE,HEW2.exe 2013/10/04 15:40:11;PC301359;drussef;HEW2.exe;EcxMonitor;,explorer.exe,,bacbeat.exe,bacbeat.exe,bacbeat.exe,explorer.exe,sidebar.exe,sidebar.exe,explorer.exe,explorer.exe,OUTLOOK.EXE,OUTLOOK.EXE,HEW2.exe 2013/10/04 15:40:17;PC301359;drussef;HEW2.exe;EcxMonitor;,explorer.exe,,bacbeat.exe,bacbeat.exe,bacbeat.exe,explorer.exe,sidebar.exe,sidebar.exe,explorer.exe,explorer.exe,OUTLOOK.EXE,OUTLOOK.EXE,HEW2.exe 2013/10/04 15:40:23;PC301359;drussef;HEW2.exe;EcxMonitor;,explorer.exe,,bacbeat.exe,bacbeat.exe,bacbeat.exe,explorer.exe,sidebar.exe,sidebar.exe,explorer.exe,explorer.exe,OUTLOOK.EXE,OUTLOOK.EXE,HEW2.exe 2013/10/04 15:40:29;PC301359;drussef;HEW2.exe;EcxMonitor;,explorer.exe,,bacbeat.exe,bacbeat.exe,bacbeat.exe,explorer.exe,sidebar.exe,sidebar.exe,explorer.exe,explorer.exe,OUTLOOK.EXE,OUTLOOK.EXE,HEW2.exe My props.conf: [RUL] NO_BINARY_CHECK = 1 pulldown_type = 1 CHECK_FOR_HEADER = false REPORT-AutoHeader = AutoHeader-1 My transforms.conf: [AutoHeader-1] DELIMS = ";" FIELDS = "TIMESTAMP", "HOSTNAME", "USERNAME", "PROCESS", "WINDOW", "OTHER_PROCESSES" When I add a new input pointing to this log file, and choosing the RUL sourcetype I have a good preview: File properties Path /data/RUL.log Bytes 1,420,726 number of events extracted 9,999 Event time distribution 10/4/13 3:00 PM10/8/13 11:00 AM Event linecount distribution lines per event # of events 1 9,999 (100%) But at the top of the screen a have an error message: "Failed to decode 1 bytes; Failed to decode 10 bytes" After finhishing, trying to search on the RUL soucetype, appears that nothing become indexed. PS. Runnuning Splunk 6.0 Thanks in advice.

Posts	25
Solutions	1
Karma Given	3
Karma Received	0
Member Since	‎11-14-2012

Online Status	Offline
Date Last Visited	‎07-26-2023 06:28 AM

Trying do not use a join

How to get a token and run a collect when click on...

Why are there empty fields after a left join?

How to pass values to a eval if subsearch?

How to filter table results?

Splunk DB Connect 2: Why am I getting "No rpc serv...

Mail Journal Header Log

transforms.conf delimiter ASCII

Trying do not use a join

Re: Why are there empty fields after a left join?

Re: Why are there empty fields after a left join?

How to get a token and run a collect when click on...

Re: empty fields after a left join

Why are there empty fields after a left join?

Re: How to pass values to a eval if subsearch?

How to pass values to a eval if subsearch?

Re: How to filter table results?

How to filter table results?

Re: Splunk DB Connect 2: Why am I getting "No rpc ...

Re: Splunk DB Connect 2: Why am I getting "No rpc ...

Splunk DB Connect 2: Why am I getting "No rpc serv...

Re: Mail Journal Header Log

Re: Mail Journal Header Log

Re: Mail Journal Header Log

Re: Mail Journal Header Log

Re: Mail Journal Header Log

Re: Mail Journal Header Log

Re: Mail Journal Header Log

Mail Journal Header Log

Re: transforms.conf delimiter ASCII

Re: transforms.conf delimiter ASCII

transforms.conf delimiter ASCII

Re: Failed to decode 1 byte