Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About aking76
aking76
Path Finder
Member since:
03-06-2019
12-04-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 8 |
| Karma Received | 2 |
| Member Since | 03-06-2019 |
Activity Feed
- Posted Re: Trying to take a value from one search and place it in another search on Splunk Search. 12-04-2020 11:38 AM
- Posted Trying to take a value from one search and place it in another search on Splunk Search. 12-03-2020 02:04 PM
- Tagged Trying to take a value from one search and place it in another search on Splunk Search. 12-03-2020 02:04 PM
- Tagged Trying to take a value from one search and place it in another search on Splunk Search. 12-03-2020 02:04 PM
- Tagged Trying to take a value from one search and place it in another search on Splunk Search. 12-03-2020 02:04 PM
- Tagged Trying to take a value from one search and place it in another search on Splunk Search. 12-03-2020 02:04 PM
- Karma Re: Find average for multiple hosts for rbechtold. 06-05-2020 12:50 AM
- Karma Re: Get average connections for the past few days, compare to current connections for woodcock. 06-05-2020 12:50 AM
- Karma Re: How to combine two searches into one table using count twice for woodcock. 06-05-2020 12:50 AM
- Karma Re: Splunk as a SIEM Best Practices for Security Professionals for ChrisG. 06-05-2020 12:50 AM
- Karma Re: Splunk as a SIEM Best Practices for Security Professionals for wenthold. 06-05-2020 12:50 AM
- Got Karma for Re: Find average for multiple hosts. 06-05-2020 12:50 AM
- Got Karma for Splunk as a SIEM Best Practices for Security Professionals. 06-05-2020 12:50 AM
- Karma How to get the overall average and average per 5 minutes on a Time Chart? for angersleek. 06-05-2020 12:49 AM
- Karma Re: How to get the overall average and average per 5 minutes on a Time Chart? for renjith_nair. 06-05-2020 12:49 AM
- Karma Re: Using saved search as a "variable" for masonmorales. 06-05-2020 12:48 AM
- Posted Re: How to combine two searches into one table using count twice on Splunk Search. 09-09-2019 06:44 AM
- Posted Splunk as a SIEM Best Practices for Security Professionals on Security. 07-25-2019 10:14 AM
- Tagged Splunk as a SIEM Best Practices for Security Professionals on Security. 07-25-2019 10:14 AM
- Tagged Splunk as a SIEM Best Practices for Security Professionals on Security. 07-25-2019 10:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-04-2020
11:38 AM
Thanks. I'm just waiting to get verification that the ContextProcessId_decimal does correlate to the TargetProcessID as I was originally told. In the meantime, what if both searches have the same value. For instance, say they both have the ContextProcessId_decimal field. Can I rename the first and then compare and pull in the information similar to above?
... View more
12-03-2020
02:04 PM
I have a search that runs with no issues- ComputerName=CompName* (event_simpleName=*written* OR event_simpleName=DirectoryCreate OR event_simpleName=*CreateFile) *.xls* OR *.csv | rename FileName as WrittenFileName, FilePath as SourceFilePath, TargetFileName as DestinationFileName | table _time, ComputerName, WrittenFileName, SourceFilePath, DestinationFileName, sourcetype, ContextProcessId_decimal,TargetProcessId_decimal What I want to do is take the value from ContextProcessId_decimal and use it in a second search as the value for the field TargetProcessId_decimal. event_simpleName=ProcessRollup2 OR event_simpleName=SyntheticProcessRollup2 TargetProcessId_decimal=ContextProcessid_decimal I've tried doing a search within the first search like the following, but it errors out. I've spent a good hour or two and have been unable to figure this out. -_- ComputerName=CompName* (event_simpleName=*written* OR event_simpleName=DirectoryCreate OR event_simpleName=*CreateFile) *.xls* OR *.csv | rename FileName as WrittenFileName, FilePath as SourceFilePath, TargetFileName as DestinationFileName [|search event_simpleName=ProcessRollup2 OR event_simpleName=SyntheticProcessRollup2 TargetProcessId_decimal=ContextProcessid_decimal] | table _time, ComputerName, WrittenFileName, SourceFilePath, DestinationFileName, sourcetype, ContextProcessId_decimal,TargetProcessId_decimal If I leave the renames in it gives an error with that, if I take the rename out it finds no results. Any help would be greatly appreciated!!
... View more
09-09-2019
06:44 AM
Can you perhaps help me understand the last part of the search? I would like to learn what's happening here. I really appreciate the help.
| eval which=if(which==1, "CURRENT", "PAST") --Where is the "CURRENT" and "PAST" coming from?
| where which=="CURRENT" --Why are you looking for where which == current?
... View more
Just curious if there is any documentation to help understand the best practices to use Splunk Enterprise as a SIEM for Security Professionals / SOC analysts.
Or if anyone has any input, that would be appreciated as well.
I have been evaluating Splunk Security Essentials, which I've been using to create dashboards.
... View more
07-22-2019
12:02 PM
Error in 'append' command: The last argument must be a subsearch.
... View more
07-22-2019
11:51 AM
Yeah I have, it errors out.
I've also saved both searches and called them using the savedsearch function, but that just sits there and spins forever.
... View more
07-22-2019
10:24 AM
I have two searches, one getting the current connections and the other getting an average. I'm trying to grab the fields from both and combine them into one table. Both searches work by themselves, however, it looks like something is off when it comes to the count field.
When I run them by themselves, I can get the current_count or avg_count, when they run together, it doesn't display the values for these fields.
index=network* (src_ip = 10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) AND (dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16) dest_port=* action=allowed
| bin _time span=15m
| eventstats count BY src_ip dest_ip _time
|rename count AS current_count
| rename src_ip as Source_ip, dest_ip AS Destination_ip, count AS curr_count
| eventstats first(current_count) AS Current_Connections BY Source_ip Destination_ip
|append
[search earliest=-24h latest=+23h
| bin _time span=15m
|eventstats count BY src_ip dest_ip _time
|rename count AS avg_count
|eventstats avg(avg_count) BY src_ip dest_ip AS average_count
]
table *
... View more
07-20-2019
06:06 AM
Looks like it works. Thank ya much!
... View more
07-19-2019
01:44 PM
I have the following search, I'm trying to get it to show the src , dst , current amount of connections, and then an average of how many times the src connects to the dst .
Something doesn't seem right with the code I have, I think something is wrong with the avg function I have in there.
I would like it to go back a few days and give me the average amount of connections based on those results and then show me what's currently happening.
For instance:
src dst Current AVG
0.0.0.0 0.0.0.1 4450 300
This is not right:
index=net_index* (src_ip = 10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) AND (dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16) dest_port=* action=allowed
|eventstats count by dest_ip | rename count as "Current Connections"
|bucket span=15m _time
|eventstats count by src_ip | rename count as "Average Connections"
|table src_ip, dest_ip,"Current Connections", "Average Connections"
... View more
- Tags:
- avg
- splunk-cloud
07-18-2019
01:04 PM
Oh so I do have one follow up question. It looks like it's pulling an average for all the connections and putting them in the last column.
If you have a quick thought on this, it would be much appreciated, if not, no worries, I'll continue searching.
... View more
07-18-2019
12:55 PM
1 Karma
Thank you soooo much! I was searching and searching, trying to figure this out and you solved it in a blink of an eye! You rock! Thank you!
... View more
07-18-2019
10:19 AM
I'm trying to create a search that will show the average connections per host and then the current connections. The goal is to be able to see the deviation between the average and what's actually happening.
I've tried several searches to get the average per each host and it's failing miserably. Here's my last attempt-
index=network_index_name (src_ip = 10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) AND (dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16) dest_port=* #Show internal connections only
|stats count by src_ip,dest_ip #Count the dest connections via the source ip
|stats avg(count) as Average_connections #Create an average
My end goal is to get something like this-
Source_IP Destination_IP Current_Connections Average_Connections
... View more
03-14-2019
10:27 AM
I created a map showing connections outside the US but when I hover over the markers it only shows the lon and lat. I would like to have it show the IP instead.
Is it also possible to have it display the statistics? That way I have a table showing these connections and then the map as well.
Currently, I have a map and a stats table that I put on the dashboard but I would like to have these combined if possible.
Here's my query to show the connections outside the US on a map.
index=syslog earliest=-6h NOT
| iplocation dest_ip|search NOT Country="United States"
|geostats count
Here's the same query that I have displayed as a statistics table-
index=syslog* earliest=-6h
| iplocation dest_ip|search NOT Country="United States"
| Table dest_ip count City Country|rename dest_ip as "Destination IP" count as "Connections"
|Sort by Country
... View more
