Hello, I am trying to create a correlation search that will detect users accessing devices for which they aren't authorized to use. For example, Vendor A should not be able to Access a specific file server because that is not part of their assigned role. My theory is as follows: Create a summary index search that logs AD events including username, src, dest etc. based on whether their username is in a lookup table. This lookup table has 2 fields: User and Vendor Name. I have tried the following search with little success: index=wineventlog dest!=mailServer dest!=DomainController Account_Domain=Domain | search [| inputlookup vendor_users.csv | return 1000 $user] | stats count by user | rename user as username | appendcols [| inputlookup vendor_users.csv| search user=$username$ | return 1000 $vendor_name] All I expect from the search above is a table with user, vendor_name and count as fields. However, this just creates and empty column called "search", when I omit the search part it shows "VendorA OR VendorB or VendorC" etc. This summary index will contain |table _time,user,vendor_name,src, dest which will then be used in another search using other lookup tables that provide an ACL matrix based on Vendor. Can anyone provide any insight into what is wrong with my logic? Regards, ... View more

Hi everyone, I am having an issue where a logical AND NOT isn't working properly. Simply put I have an alert for mail servers that should be whitelisting a single IP's communication with either one of two IPs. index=* tag=network NOT (src_ip=10.100.90.34 AND dest_ip=10.100.1.1) NOT(src_ip=10.100.90.34 AND dest_ip=10.100.1.2) (dest_port=25 OR dest_port=465 OR dest_port=2525 OR dest_port=110 OR dest_port=995 OR dest_port=143 OR dest_port=993) NOT [ | inputlookup Inventory | eval category=split(asset_category, "|") | search category="Email" OR category="Mail" | return 100 $asset_ip ] | eval is_local=`local_ip_list(src)` | where is_local=1 | stats earliest(_time) as Timestamp, values(dest) as "Destination IP", values(app) as Application, values(dest_port) as Port, values(user) as Username, earliest(_raw) as "Raw Log", count by src | convert ctime(Timestamp) | rename count as Correlated src as "Source IP" | search Correlated >29 My issue is that the alert is firing for communication between 10.100.90.34 and 10.100.1.1 or 10.100.1.2, IP A,B and C respectively. I've tried NOT(A (B OR C)) Also: NOT(A B) NOT(A C) Based on both logical expressions the results should not include communication between those 2 devices. Note: I am unable to modify the inventory lookup table, and, I have tried the search without the sub-search with the same result, except of course having my lookup table results included in the alert. Thanks for taking the time to read this. ... View more

I wrote a script that does the following: cat $SPLUNK_ARG_8 > /tmp/$SPLUNK_ARG_4.csv Unfortunately, I am getting lots of characters similar to: 噪 instead of the logs. The logs are in English, and I can read them. The script output is not. I am running Splunk on Redhat. Has anyone encountered this kind of error before? ... View more

I am trying to calculate the average number of sessions per hour based on "off hours" 5pm to 9 am. I have the time range and events, I just need to do the math. This returns an empty result set: Search here | stats count(sessionid) as total2 | stats avg(total2) by date_hour This returns a time chart but it's averaging the values of sessionid (which is a numeric field): Search here | timechart span=24h per_hour(sessionid) as AvgPerHour and finally, this returns the count per hour as expected but I'm at a loss as to how to average based on this count: search here | stats count(sessionid) by date_hour Thanks in advance for reading. ... View more

I am trying to create a baseline for average outbound connections per day/week/month. I started with this as my search: source=fwlogs earliest=-2mon@m latest=@m NOT (dstip=10.0.0.0/8 OR dstip=172.16.0.0/12 OR dstip=192.168.0.0/16) | stats count by src, dst, srcprt | stats avg(count) by 1d@d* However, there doesn't seem to be any results. The fields are correct, and it shows a table listing with dst, src count when I remove the part of the search after the last pipe. My goal is to return 3 fields: Average Connections per day, per week, and per month that I can print to a flat file. Any help would be greatly appreciated. ... View more