Hi, I seem to be stuck with something pretty trivial. I have events with users and corresponding hostnames, eg: User Hostname user1 hostA user1 hostB user2 hostA user2 hostC user3 hostD   I want to count unique user-hostname values and show the contributing hostnames for users that have used more that 1 hostname like this: User Hostnames used user1 hostA hostB user2 hostA hostC   This seems to take care of the first part of the task:     | stats dc(Hostname) as uh by User | search uh > 1       How can I add the contributing Hostnames? Formatting is not so important - it may be one field with all the hostnames like in the example above, or multiple fields, or one field together with the User field.   Thank you.     ... View more

Hi! I want to use a tstats search to monitor for network scanning attempts from a particular subnet: | tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16 by All_Traffic.src | sort - dest_count | where dest_count > 70 My index2 contains IP addresses and users (src_ip, user and event contains text string "LOCAL") that I would like to match with the All_Traffic.src IP addresses, so I would get the last user name that used the particular All_Traffic.src in the results. I have tried both join and map with no success: | tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16 by All_Traffic.src | sort - dest_count | where dest_count > 70 | rename All_Traffic.src AS src_ip | join type=left src_ip [search index=index2 "LOCAL" | head 1 | fields src_ip user ] | table All_Traffic.src dest_count user join returns All_Traffic.src and dest_count without users. | tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16 by All_Traffic.src | sort - dest_count | where dest_count > 70 | rename All_Traffic.src AS srcip | map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 | fields user" | table All_Traffic.src dest_count user map returns users, but no All_Traffic.src and dest_count What is the correct way to get the results I need? Thank you. ... View more

Anybody else having issues with search operator '!=' after upgrading to Splunk Enterprise 8? My search is index=myindex | search src_ip!=10.0.0.0/8 and after the upgrade Splunk started to return all the local addresses in the search results. Any ideas what to do? ... View more

Let's assume I have data structured like this: |timestamp|user|action| |2019-09-10 13:40|user1|action1| |2019-09-10 12:40|user2|action2| |2019-09-09 12:40|user3|action3| |2019-09-09 13:40|user1|action1| |2019-09-09 12:40|user3|action4| |2019-09-09 11:40|user1|action1| |2019-09-09 09:40|user2|action2| Now, I would like to search for events where users have performed the same actions, in this case, I would like to have these events in my search: |2019-09-10 13:40|user1|action1| |2019-09-09 13:40|user1|action1| |2019-09-09 11:40|user1|action1| |2019-09-10 12:40|user2|action2| |2019-09-09 09:40|user2|action2| I tried subsearches and selfjoin, but to no avail. In what direction should I look? ... View more

I have a DB Connect input: SELECT EVENT_ID, EVENT_TYPE, ... FROM table WHERE EVENT_ID > ? ORDER BY EVENT_ID ASC . The fields in the result all come with a column name, eg: EVENT_ID="225894621", EVENT_TYPE="QUERY_BILLS",... EVENT_ID="225894620", EVENT_TYPE="CONN_SERVICE",... etc. It seems to me that it's an unnecessary overhead. Can I get rid of the column names? ... View more