Good morning Splunkers, I trust everyone is remaining safe. Ultimately, I'm attempting to obtain the overage connection duration of external IPs for each destination zone based on firewall logs. The reporting period would be 24h. So the output I'd be looking for is something like this: dest_zone AvgDuration ABC App 00:00:07:123 123 Zone 00:00:13:123 Cisco VPN 00:07:12:004 Please see my non-working query below: index="pan_logs" sourcetype="pan_traffic" action="allowed" | eventstats earliest(_time) as earliest_time by src_ip | eventstats latest(_time) as latest_time by src_ip | eval Duration=latest_time-earliest_time | stats avg(Duration) as AvgDuration by src_ip | eval AvgDuration = strftime(AvgDuration/1000 , "%H:%M:%S:%3Q") | stats values(AvgDuration) by dest_zone As always, any help is greatly appreciated. ... View more

I do not have any admin privilege in my Splunk instance and cannot change any configuration. Need to search an index for any value matching what's in a lookup file. The problem is the file contains 130K records and I get a maxout truncation at 10K. How do I overcome this? If you plan to tell me to split it up into 10K files, please don't. index="bro" [ inputlookup bad_domains | fields domain ] |stats values(domain) by _time ... View more

Anyone know of a way to only return the matching values of a sub search to the string array field in the parent search? index="email" sourcetype="email_links" [ search index="sinkholed" sourcetype="bad_http" | rename raw_host as "extracted_host{}" | fields "extracted_host{}" ] | stats dc("rcptto{}") as recipient_dc values("rcptto{}") values("extracted_host{}") values(subject) by from | sort recipient_dc The query works fine except I'm getting back more than I want. The results I get back in the "extracted_host{}" field are everything in that particular field value array instead of just the matching criteria. For example, in the sub-search let's say there is a sinkhole domain called baddomain.com. The results I see in "extracted_host{}" are: baddomain.com www.w3.org abc123advertisement.com etcetcetc.com Would like to only return what matched in the sub-search. Any assistance is greatly appreciated. ... View more

Okay so this question has never been asked or answered before so here goes...Hoping someone can assist. index="ironport" [ inputlookup exfil_filenames | fields file_name ] | table file_name matching_criteria The above query has a lookup which has 2 columns: file_name, matching_criteria. The only difference between them is the items in matching_criteria do not have asterisks. Example: file_name matching_criteria *hello* hello *world* world Currently the query returns files that match the lookup field "file_name" but in addition to that I also need the corresponding matching criteria value to be associated and returned in the main search. So this is what I'd like to see as the result: | table file_name matching_criteria file_name matching_criteria hello_file.xls hello world_bank.virus world SSN_dump.zip SSN God speed! Hopefully I explained it clearly. Thanks in advanced. ... View more

I'm trying to consolidate my dashboards as the only difference between them are token values (same search criteria/logic). I am seeking guidance on how to construct the following: A dropdown menu that will swap numerous tokens (in the various panels) based on the selected value in the dropdown menu. Example: If the dropdown menu were to be "Hotel Selector" with the options: Marriot Holiday Inn Four Seasons Each option has it's own set of tokens (email address, email subject, hotel domain name, ip address). So if you were to select the first dropdown item (Marriot), the 4 tokens mentioned above will populate with the predefined values for that respective option (i.e. support@marriot.com, Marriot, marriot.com, 1.1.1.1) and refresh the panels with that option specific data. If however, you selection option 2 (Holiday Inn), the token values would swap and instead be support@holidayinn.com, Holiday Inn, holidayinn.com, 2.2.2.2, etc. Hopefully I explained this okay. Appreciate any feedback. If there's a better way of going about this, I'm open to suggestions. Thanks in advanced. ... View more