reswob4, any chance you can share the information from this site? Looks like its currently down and I am also trying to get rid of the (3) etc from my DNS logs. ... View more

Tony, I am currently working with the TA and seeing some parsing issues with ex logs being parsed incorrectly by the TA. Do you know if the json via syslog format has been resolved as you mentioned above? We are considering maybe switching the ex collection to json over https due to the issues with syslog and json. We currently have no issues with our NX / HX devices and seems to be an issue with just our ex device log collection. thanks in advance and sorry for the bump ... View more

Is there any way to further filter before doing the transaction command? IE i have a subject of a spam email so I want to see the full event list. When I insert a search modifier, it takes away the transaction portion of the events. sourcetype="cisco:esa:legacy" | transaction mid dcid icid maxevents=10 maxspan=5s mvlist=t I would want to add sourcetype="cisco:esa:legacy" subject="Dogs are cool" | transaction mid dcid icid maxevents=10 maxspan=5s mvlist=t ... View more

any update on this? ... View more

Was able to get it working perfectly. Thanks again for all of your help sundareshr. ... View more

I get under the statistics, no results found when I made the selected changes. index=network sourcetype=nessus severity!=informational (earliest=-120d@d latest=-90d@d+1d) OR (latest=-30d@d earliest=@d) dest_dns=hqw0prd1rebs61.ent.pbgc.gov | dedup signature_id, dest_dns | eval hostnamesplit=split(dest_dns,".") | eval hostnamesplit=mvindex(hostnamesplit,0) | lookup AssetTag.csv Asset as hostnamesplit OUTPUT BusinessUnit1 System1 | eval Combo=mvzip(BusinessUnit1, System1) | fields - System1, BusinessUnit1 | mvexpand Combo | makemv Combo delim="," | eval BU1=mvindex(Combo,0) | eval Sys1=mvindex(Combo,1) | fields - Combo | dedup hostnamesplit signature_id BU1 Sys1 | eval x=BU1."^".signature."^".Sys1."^".dest_dns."^".severity | rex field=x "(?<BU1>[^\^]+)\^(?<signature>[^\^]+)\^(?<Sys1>[^\^]+)\^(?<dest_dns>[^\^]+)\^(?<severity>[^\^]+)" | stats values(month) as months by x | where mvcount(months)=2 | fields - months | rename Sys1 AS "System", signature AS "Signature", BU1 AS "Business Unit",dest_dns as "Host" severity as "Severity" Is what my query is as of now. ... View more

I have also noticed that its not making sure that events were found in both time ranges. For instance, It's displaying results that were found in June but if I do a separate search, that signature doesn't show up in the past 30 days. Any other suggestions on how to resolve the issue? ... View more

Say that our scan results are dumped in over periods of time so not just one month. Am I able to do something like this index=network sourcetype=nessus severity!=informational dest_dns=hqw0prd1rebs61.ent.pbgc.gov (earliest=-120d@d latest=-90d@d+1d) OR (earliest=-30d@d latest=@d) Sorry for the late response, revisiting this subject and running into a few issues. ... View more

bin command needed another argument with _time but that did work | eval _time=strptime(Date, "%-m/%-d/%Y") | bin span=1mon _time | ... View more

Do you guys see a way to contain that number by the bin span or due to the eval needing to come after the sum or am I forced to use the highest distinct count? ... View more

Worked like a charm. Thanks again for the help. Is there anyway for the MAX(dest_dns) to be specific to the month... for instance with the search, it will take that MAX and apply it to every month regardless of the max during that time frame so results are off for months where the number was low. ... View more

Does this compare the two time frames in the initial search? So basically this should return anything that was found today that also was found 90 days ago. ... View more

Error in 'SearchParser': Missing a search command before '^'. Error at position '791' I also had a rogue ] in the search ... View more