Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About frbuser
frbuser
Path Finder
Member since:
01-15-2019
02-03-2022
Community Statistics
| Posts | 34 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 01-15-2019 |
Activity Feed
- Posted Re: How to Regex match literal \U in directory path on Splunk Search. 02-03-2022 10:52 AM
- Posted Re: How to Regex match literal \U in directory path on Splunk Search. 02-03-2022 10:20 AM
- Posted How to Regex match literal \U in directory path on Splunk Search. 02-03-2022 09:02 AM
- Posted Re: How to search for strings in secondary search without _raw field available? on Splunk Search. 11-13-2020 09:33 AM
- Tagged How to search for strings in secondary search without _raw field available? on Splunk Search. 11-12-2020 01:40 PM
- Tagged How to search for strings in secondary search without _raw field available? on Splunk Search. 11-12-2020 01:40 PM
- Posted How to search for strings in secondary search without _raw field available? on Splunk Search. 11-12-2020 01:24 PM
- Karma Re: How to do stats or top for each column in a table? for acharlieh. 06-05-2020 12:47 AM
- Posted Re: How to only include an input token in search if it has a value on Dashboards & Visualizations. 04-14-2020 11:16 AM
- Posted How to only include an input token in search if it has a value on Dashboards & Visualizations. 04-14-2020 10:25 AM
- Tagged How to only include an input token in search if it has a value on Dashboards & Visualizations. 04-14-2020 10:25 AM
- Posted Re: What are transaction evicted and orphaned events? on Splunk Search. 03-30-2020 01:06 PM
- Posted Re: What are transaction evicted and orphaned events? on Splunk Search. 03-30-2020 12:08 PM
- Posted Re: What are transaction evicted and orphaned events? on Splunk Search. 03-30-2020 11:14 AM
- Posted Re: What are transaction evicted and orphaned events? on Splunk Search. 03-30-2020 10:39 AM
- Posted Re: What are transaction evicted and orphaned events? on Splunk Search. 03-30-2020 06:53 AM
- Posted Re: What are transaction evicted and orphaned events? on Splunk Search. 03-26-2020 01:27 PM
- Posted What are transaction evicted and orphaned events? on Splunk Search. 03-26-2020 12:18 PM
- Tagged What are transaction evicted and orphaned events? on Splunk Search. 03-26-2020 12:18 PM
- Tagged What are transaction evicted and orphaned events? on Splunk Search. 03-26-2020 12:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-03-2022
10:52 AM
Ok I see that. But how come in your eval statement you needed only 2 backslashes for 1 literal backslash? I also tried changing it to one literal backslash in the eval and it still produce 1 literal backslash in the resulting value?
... View more
02-03-2022
10:20 AM
@ITWhisperer The actual directory is something like this, "C:\Users\abc\Downloads\file.exe" In your example, 4 backslashes would match literal 2 consecutive backslashes such as "\\" no?
... View more
02-03-2022
09:02 AM
I am trying to match a directory path including the string "\Users" but Splunk is throwing an error: | rex field=TargetFilename "C:\\Users\\\w+\\AppData\\(?<File_Dir>.*)\." Error in 'rex' command: Encountered the following error while compiling the regex 'C:\Users\\w+\AppData\(?<File_Dir>.*)\.': Regex: PCRE does not support \L, \l, \N{name}, \U, or \u. How can I literally match the path?
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
11-13-2020
09:33 AM
@ITWhispererI am trying to filter out rows that don't contain the "string" being searched for in any of their fields. My point is that specifying a secondary search like this doesn't work. Your assumption is incorrect. Even if an extracted field contains "string" after that stats command, searching for it using the search command as shown in my example doesn't work. If I specify a specific field it will work but the point is, I'm not always going to know which field to search so I want to search for the "string" across all fields. The reason it doesn't work is because by default when you use the search command and you don't specify a field, it searches the _raw field for your text. After the stats command, this field no longer exists in the output it seems. My question is given this scenario, how can I search for "string" in an event list and filter out rows that don't contain the "string" when I don't know which specific field/column may contain the "string". Test it out your suggestion and see if it works.
... View more
11-12-2020
01:24 PM
index::my_index host::my_host source::my_source sourcetype::my_sourcetype field1="some value"
| stats list(*) AS * BY field2
| search "string" The above query will fail because the secondary search no longer has the _raw field to search against. How would you perform a string based search across all available fields in the secondary search without the _raw field?
... View more
Labels
- Labels:
-
other
04-14-2020
11:16 AM
@manjunathmeti That's AWESOME! It works for the "text" input type. How would you do the same for muli-select inputs?
... View more
04-14-2020
10:25 AM
I have a form dashboard that has several input fields. How do I only use a token if it has a value? Mean I may want to leave the input blank and not pass anything to the search. So the input is optional.
The reason is my results don't always include some fields in every log. So if pass * as the default and it ends up being field=* this will exclude logs which don't have the field present. How do I get around this?
I only want my search to become field=$input$ if the user actually filled out the input. Otherwise I want the entire line removed.
... View more
03-30-2020
01:06 PM
there are* many ways.
... View more
03-30-2020
12:08 PM
OK so the way I would describe that is orphaned events are logs which don't contain the transaction field(s).
Do you know how to filter out the events that weren't combined other than using linecount>2?
... View more
03-30-2020
11:14 AM
in my case, the results are the same, meaning I get the same number of events regardless of if keeporphans is true or false. I am only using transaction on one field.
How are you defining a "transaction group"?
... View more
03-30-2020
10:39 AM
yes I still see events that show up in the results where linecount=1. So that still doesn't answer my Q as it seems events which have not been grouped still show up in the results whether true or false.
... View more
03-30-2020
06:53 AM
so keeporphans will keep logs that were NOT grouped together in the results?
... View more
03-26-2020
01:27 PM
it's not clear from this what they are. It only tells you how to keep them. Orphans sounds like events that aren't in transactions. But it's not clear under what circumstances this happens.
... View more
03-26-2020
12:18 PM
In regards to the transaction command, what are orphaned events and evicted events?
Is there a way to filter out logs which were not combined with other logs after using the transaction command?
... View more
03-16-2020
10:46 AM
Query
index::dlp
| bucket _time span=1d
| stats count(EVENT_DESCRIPTION) AS "Count" BY _time,User_Name,EVENT_TYPE,EVENT_DESCRIPTION
| stats median(Count) AS "Median" BY _time,EVENT_TYPE
I am trying to calculate the average or median number of DLP events per user per day for each different type of events. I don't think my query is correct as some of the numbers don't make sense.
I don't actually want to see the average number for each user, I just want to calculate the statistic for all users. I don't know if that makes sense. For example if there are 12 users and 3 types of events, I want to know on day 1 what the average number of events for each event type would be per user. But the result would only show 3 numbers which are the averages for each event type. So if they results were:
Send Mail: 10
Upload: 2
Download:5
I would interpret this as on day 1, each user had an average of 10 send mail events etc.
Ideally I would like to calculate this for any time frame.
... View more
10-30-2019
07:18 AM
I think I figured it out:
| rex field=Process_Command_Line "(?<Script>\w:[-\w\s\\\]+\.ps1)"
... View more
10-30-2019
07:07 AM
I am trying to use a regex to extract a PowerShell script that is being executed in a way that also includes the directory of the script.
Query
| rex field=Process_Command_Line "\w:(?<Script>[\\\w\\\\\s]+\.ps1)"
It's not working due to the way Splunk is processing the back slashes.
How do I match a literal back slash, a word character, and space within a character class in Splunk?
... View more
- Tags:
- regex
09-09-2019
11:21 AM
@starcher eval length=len(Country) doesn't return any numeric value for some fields that have no visible value. These appear to be the null values. If I combine isnotnull(Country) AND NOT len(Country)=0 this appears to work.
... View more
09-09-2019
11:01 AM
@starcher how do you check that the len of a field is not 0?
... View more
09-09-2019
10:58 AM
@richgalloway what is isnotnull(blank) ?
... View more
09-09-2019
10:15 AM
@richgalloway where also does not work. Per my original question, the problem is that the isnotnull() function is returning true for some fields that are blank.
... View more
09-05-2019
02:04 PM
@richgalloway Entries with blank values still show up with that.
... View more
09-05-2019
12:26 PM
I am using the iplocation command on an IP based field to add new fields to each event, most importantly the Country field. I want to then filter the output to only entries where the Country field is not blank. I tried using:
Country=*
but entries with blank values still are returned.
I also tried using:
isnotnull(Country)
but it returns true where the field is clearly blank. Can anyone explain this behavior?
My query:
index::proxy host::proxyhost sourcetype::bcoat_log
| regex cs_host="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| top cs_host limit=0
| iplocation cs_host
| search Country=*
| eval null=if(isnotnull(Country),"true","false")
... View more
08-14-2019
08:29 AM
Seems like this worked. Thanks!
... View more
08-14-2019
08:00 AM
Creator_Process_ID exists as a field already in both searches.
... View more
