About mayurr98

mayurr98 · ‎05-04-2023

Hello Splunkers, I have an event like this: blocked,Adware,ABCD,test.exe,\\program_files\c\Drivers\,,,Generic PUA JB,,Endpoint Protection I am extracting fields using comma separator delimiter, so my props.conf and transform.conf is: transforms.conf [cs_srctype] CLEAN_KEYS = 0 DELIMS = , FIELDS = action,category,dest,file_name,file_path,severity,severity_id,signature,signature_id,vendor_product props.conf [cs_srctype] KV_MODE = none REPORT-cs_srctype = cs_srctype Now the output that I am getting is : file_path = \\program_files\c\Drivers\, severity= severity_id= Generic PUA GB signature= signature_id= Endpoint Protection vendor_product= All the fields before file_path are getting extracted properly and after file_path are incorrect because it's adding comma and thus not separating properly. how do I ignore the \, and extract the fields properly. Thank you in advance

mayurr98 · ‎06-09-2022

hello, what are you trying to achieve? Could you please give us input and expected output in tabular format. Isn't it should be | eval hours=if(day="Mon",hours+2,hours)

mayurr98 · ‎06-08-2022

The SEDCMD script applies only to the _raw field at index time. With the regular expression transform, you can apply changes to other fields https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata?_gl=1*16ogb9v*_ga*MTA1MzM4MzA5NS4xNjQ2NDE5MTg2*_gid*MTQyMDA2ODcwNS4xNjU0NzA0NTg4&_ga=2.135579313.1420068705.1654704588-1053383095.1646419186#Caveats_for_anonymizing_data you can try using evaluation functions as well | makeresults | eval _raw="Process Create:true Utc Time: 2022-04-28 22:08:22.025 Process Guid: {XYZ-bd56-5903-0000-0010e9d95e00} Process Id: 6228 Image: chrome.exe Command Line: test" | rex field=_raw max_match=0 "(?<field>[a-zA-Z ]+):(?<value>.+)" | mvexpand field | eval field1=replace(field,"\s","_") see if you can use calculated fields if its not a multivalue field.

mayurr98 · ‎06-08-2022

Hello, you can achieve this using SEDCMD Scripts https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Anonymizedata#Example_of_substitution_using_a_sed.2FSEDCMD_script Transforms.conf must be used for the extracted field, and SEDCMD for _raw. See here for details. way at the bottom. https://answers.splunk.com/answers/739964/need-sedcmd-help.html

mayurr98 · ‎04-12-2022

Look at the splunk documentation whats new and fixed issues. https://docs.splunk.com/Documentation/Splunk/8.2.4/ReleaseNotes/MeetSplunk#What.27s_New_in_8.2.4 https://docs.splunk.com/Documentation/Splunk/8.2.6/ReleaseNotes/MeetSplunk#What.27s_New_in_8.2.6 Should not be a major difference.

mayurr98 · ‎04-12-2022

Could you please give us sample JSON raw events. paste in </>

mayurr98 · ‎04-12-2022

you have to try something like this to make it work with lookups https://community.splunk.com/t5/Splunk-Search/Using-CIDR-in-a-lookup-table/m-p/35787 like/accept if it works for you!

mayurr98 · ‎04-11-2022

Put below in props.conf props.conf [ssc_cloakware] REPORT-extractions = field_extractions EXTRACT-server = Server\s*:\s*(?<Server>[^\,]+) This is search time field extraction so make sure you write this regex in SH. OR simply go to search head: Settings » Fields » Field Extractions » Add new Destination App: <Choose appropriate app> Name: Server Apply to: Sourcetype: <sourcetype_name> Extraction/Transform: Server\s*:\s*(?<Server>[^\,]+) Please upvote/accept to close this question if it works for you.

mayurr98 · ‎04-08-2022

Hi for the search to work you would have to write this : <your base search> | extract kvdelim=":" pairdelim="," | rex "Server\s*:\s*(?<Server>[^\,]+)" props.conf and transforms.conf is best to put on the heavy forwarder if you have one or the indexing layer. The regex that I provided is for transforms only and it works well for all the events that you have given. https://regex101.com/r/0rdToo/1 use below configuration on HF or Indexers. props.conf [ssc_cloakware] REPORT-extractions = field_extractions transforms.conf [field_extractions] REGEX = \s([^\:]+)\:\s+([^\,]+) FORMAT = $1::$2 Restart the instance after editing the configuration. I am gonna test this configuration on my lab instance. meanwhile you do the same.

mayurr98 · ‎04-08-2022

could you please give me below details: 1) please share more sample raw events 2) share the props and transforms that you have wrote 3) where did you write the props and transforms? 4) have you restarted splunk instance after updating props and transforms ?

mayurr98 · ‎04-07-2022

can you share your query with few examples?

mayurr98 · ‎04-07-2022

Well thats what "type=left" will do, it will give you results from the main search as well as the matching results from the subsearch. The above example is not matching your computerName is different, for subsearch it's PC44 and for main search it's 4GV that's why you see date,src and uri field blank in the result. Look for the one's where computerName is matching and there you should see all the fields.

mayurr98 · ‎04-07-2022

best to use "\s*" instead of "\s" if you are not sure if there will be a space is future events or not.

mayurr98 · ‎04-07-2022

could you please share more sample events as I do not see any error in your search. I have tried in this run anywhere search | makeresults | eval _raw="store license for Store 123456 2022-04-07 19:17:44,360 ERROR path not found" | rex field=_raw "Store\s123456\n\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\,\d{3}\s(?P<errortext>.*)path" | stats count by errortext From the regex I could see that you are searching for "Store 123456", please add that in the main search instead of in regex. index=* host="storelog*" "store license for Store 123456" Also is it a multiline event? that means is timestamp is on new line in raw logs or its just one line?

mayurr98 · ‎04-07-2022

Not sure if this is what you are looking for below search will give you results from the main search as well as matching results from the subsearch: if you are just interested in matching results then change type=inner index="wineventlog" source="WinEventLog:Application" | dedup ComputerName, ownerEmail, ownerFull, ownerName, ownerDept | stats values(ownerEmail) as ownerEmail,values(ownerFull) as ownerFull, values(ownerName) ownerName, values(ownerDept) as ownerDept by ComputerName | join type=left ComputerName [ search index=traffic_log src="*" uri="*" site="friendly.org" | eval date = date_month + "/" + date_mday + "/" + date_wday + "/" + date_year | mvexpand date | dedup src, uri | lookup dnslookup clientip as src OUTPUT clienthost as ComputerName | where like (ComputerName,"p%") | dedup ComputerName | stats values(src) as src, values(uri) as uri, values(date) as date by ComputerName]

Posts	1419
Solutions	272
Karma Given	43
Karma Received	409
Member Since	‎05-26-2016

Online Status	Offline
Date Last Visited	‎05-04-2023 06:36 PM

How to avoid comma separated delimiter being escap...

How to search for 3 failed logins followed by 1 su...

Salesforce Add-on for Splunk Event logs indexing l...

Oracle audit unified template SQL query not workin...

How to do POST call / webhook from Splunk Dashboar...

How to split JSON array into Multiple events at In...

Microsoft Azure Active Directory Reporting Add-on ...

Has anyone configured splunk add-on for MySQL?

Summary range is showing zero after accelerating d...

how to pass parameters to embedded reports using t...

How to avoid comma separated delimiter being escap...

Re: How do i get and eval statement to add somethi...

Re: Is there a way to remove/replace spaces in bet...

Re: Remove/replace spaces in between fieldname

Re: upgrade

Re: Why splunk Search returning duplicates?

Re: Splunk -IP address search via CIDR

Re: Fields Extraction from raw events with regex

Re: Fields Extraction from raw events with regex

Re: Fields Extraction from raw events with regex

Re: Not able to get rid of EDT timezone using strf...

Re: SubSearch with different index and pass the fi...

Re: more regex help

Re: Search not returning results

Re: SubSearch with different index and pass the fi...