Hi all, I know many questions exist similar to this one but none are useful for my particular use case. Please if somebody could advise me on how to do this, I'd appreciate it! I have a lookup table(mytable) that looks like this. (note, I can add or remove the asterisk easily - i'm just unsure if it'll be useful or not later on domains *domain.com *someotherdomain.com I created the following search but I'm not getting expected result, likely because I'm searching for exact matches rather than partial. (a queried_domain value might look like queried_domain=example.domain.com ) which explains why I tried using asterisk as a wildcard. base search | lookup mytable domains AS queried_domain OUTPUT domains | search domains=* | sort -_time | table _time request_ip queried_domain Can anyone please tell me how I'd go about doing this? Thank you! ... View more

Hello all, I'm having some trouble formatting and dealing with multivalued fields. My use case is as follows: I have sourcetype-A that returns known malicious indicators (through multi-valued fields) I have sourcetype-B that has DNS query logs from hosts I'd like to make a search where I compile a list of "known malicious" domains from sourcetype-A, and in a subsearch (with soucetype-B being the main base search), compare all queries against the list created from the subsearch to see if a host queried a "malicious domain" (different index from sourcetype-A) A sample log for sourcetype A looks like this: Field Values Event 1 indicator x.xxx.x.xx hash someDomain.com http://DomainA.com supermalicious.com Event 2 indicator someDomain.com www.domainA.com someEmailAddress@domain.com http://helpmepls.com When I use | eval indicator=mvfilter(match(indicator, "\.")) and |stats values(indicator) , I receive somewhat of expected results (hashes are now gone and values are deduped across all events), but I still have the issue of having to exclude everything else that's not a domain or a URL. I was thinking of using something like a URL parser app for Splunk to help with the formatting issues, but for that, I don't think I'm able to get by using |stats values(indicators) Expected results: someDomain.com domainA.com supermalicious.com helpmepls.com I'd appreciate if someone could point me in the correct direction or tell me if this is even possible through Splunk. Thanks! ... View more

Hi everybody, The search I'm trying to create is to alert possible brute force attacks using WindowEventLogs. I'd like to have a search (alert) that runs every hour and splits that hour into 5 minute time blocks. For each of these time blocks, I'd like to have some logic to output to a table whenever there are "X" amount of failed attempts (or more) in ANY of the 12 five minute blocks within that hour. I Imagine the results to look like this (X here is hypothetically 5): User Time Count Bob 12:00 5 Alice 12:25 6 Steve 12:55 10 The current search I have written is: basesearch sourcetype="WindowsEventLogs" eventCode=4265 etc. (with time picker set at "last 60minutes" ) | dedup _time user | bin _time span=5m | eventstats count by user | search count > 5 | table user, time, count The result of this query yields me duplicates and an overall count of how many times a user failed a logon in the whole 60 minutes time range, rather than the count of how many times user fails a login in each of the 5min intervals. I've searched all over and could appreciate some help! Thank you. ... View more