I'm trying to do some least common occurance hunting in our environment, and would like to see if I can make a search that will show me hosts with low counts of user logons (say, less than 5?). So, if my machine had me log in 30 times, and a pc tech once, even though it's legit it would show the pc tech on my machine in the search. ... View more

I found another thread where the user was trying something similar, with this string: index= | transaction src_ip,user startswith="Login failed " endswith="Login succeeded" maxspan=15m maxpause=8h | stats avg(duration) Which doesn't go off of any kind of threshold, so a single logon failure followed by a success would be shown. It was suggested, but not exactly how, to use eventstats to create a kind of count for the "Login failed"s so that a threshold could be specified, but the syntax wasn't covered, and I'm still too new to Splunk to get it right. I've been playing around with it a little bit, and was trying something like: index= | transaction src_ip,user startswith=["Login failed" | eventstats count(src_ip) as count | where count > 10] endswith="Login succeeded" maxspan=30m But it gives an error, which I kind of expected. I just don't understand the Splunk functions, syntax, and piping well enough to know how to get that startswith = . Do you have to run eventstats first and pipe that into the transaction to use the 15 failed logons in the transaction instead of "Login success", or can you do some kind of subsearch like I was trying with a different syntax? ... View more

I've been fighting with and researching Splunk regex for the past month, and I just cannot seem to get the PCREs being produced by another source to work for me for searching proxy logs in Splunk. I'm assuming there are some syntaxual differences, possibly some missing features, but I haven't been able to find any solid documentation on what those may be. Can anyone help me get the below working properly in a Splunk search? I've been trying variations on vendor = proxyname | regex = "<expressioin>" but it doesn't work. ^http:\/\/(?!www|forums?)(?:[^\.]+\.[^\.\x2f]+|[^\.]+\.[^\.]+\.(?:[^\.\x2f]+?|[^\.]+\.[^\.]+))\/[^\x3f]+\/(?:index\.php\?PHPSESSID=[^&]+?&action=(?!dlattach)[^&]+?&?|view(?:forum|topic)\.php\?[a-z]=[^&]{1,5}&[a-z]{1,3}=(?![0-9a-f]{32})[0-9a-z\._-]{13,})&?$ ... View more