Hi Guys, in my data I have time slots in this format: starttime="1403032818" for each field. the number of starttimes are 17 (search was run on the data in 17 different times) for the whole data and I only need to use the first and last start times in my search, for example if we assume the whole times like this: 140153402,...., 1402513801, 1403032818 I only need my search to run on the fields which contains the first (140153402) and the last (1403032818) start time and ignore the results regard the start times in between . How can I add this conditional (?) term to my search? Thank you so much in advance for your help. ... View more

Hi Guys, another newbe question, I hope you can help me, I made a dashboard and now I need to make variables out of fields for nearly all of the fields so this dashboard and it's own searches can be used for other data with the same format, I also need my dashboard to work afterwards. let me explain it in this way, for example here is one of my searces for dashboard: index=remedy | rex mode=sed field=source "s#/tmp/(.*).csv#\1.0/24#"| search source=$source$|sort -Status|chart count over B1 by Status |addtotals fieldname=total | sort -total | fields - total I need to define "B1" field as a variable so I could use the same search for other data which B1 field in it is called "C1" (e.g make a variable such Var for B1, which if Var=B1 the result should be the same as it was and for other data set where Var=C1 (or some other value we don't know their name yet) it should give me the result in the same format for B1 ) and also same story for index field (e.g index=remedy in current data set and the index=nmap for other data set) just for your information, I don't want to rename the field in second data set to B1 since I don't wanna do any changes by myself! is there any possibility for this? can you please help me? Thanks a lot in advance ... View more

Hi I have a table like this (there are other fields between first and last field): Var1-------...-------Varn First AB BA CA BA C Second BA AB CD Last CF BA BA CF as you can see in some rows (first and last) values for Var2 have some duplicates (e.g. in first row value BA is duplicated, and also in last one CF is the same) I want to remove the second duplicate values in each row for second column(Var2) and also remove c from first row to be like this at the end: Var1-------...-------Varn First AB BA CA Second BA AB CD Last CF BA can you please help me and tell me how can I do that? I need a general way that works for lot's of rows (checking around 256 rows to find duplicates and remove them) Thank you so much! Cheers ... View more

Hi this took at least three days of my life but I still couldn't handle it, please, I need help I have a data file includes output of nmap traces (couple of traces on different times on each IP) in our subnet like this: host starttime="1402600202" endtime="1402601288" status state="up" reason="echo-reply" address addr="128.150.254.114" addrtype="ipv4" hostnames hostname name="sunvirt01.srv.be" type="PTR" hostnames ports extraports state="filtered" count="985" extrareasons reason="no-responses" count="985" extraports: port protocol="tcp" portid="20" state state="closed" reason="reset" reason_ttl="63" service name="ftp-data" method="table" conf="3" port port protocol="tcp" portid="21" state state="open" reason="syn-ack" reason_ttl="63"/ service name="ftp" product="ProFTPD" method="probed" conf="10" cpe cpe:/a:proftpd:proftpd cpe service port port protocol="tcp" portid="22" port protocol="tcp" portid="222" state state="open" reason="syn-ack" reason_ttl="63" service name="tcpwrapped" method="probed" ... (os)portused state="open" proto="tcp" portid="21"/ portused state="closed" proto="tcp" portid="20"/ osmatch name="Linux 3.0" accuracy="99" line="47080" (...) what I need is a table to show the IP address and "open" Ports on that machine beside the service(s) are using that open port, something like this(e.g): ------ -----IP ----- ------- Ports ----- ----- Service 128.150.254.114 -------21------------------ ftp (if there are more open ports o one host they have to be listed below "Ports" by their services) I'm using this regex: (?i) portid="(?P [^"]+) to extract Port numbers but unfortunately in some cases I face with values like 21/ or duplicate values like this: 21 --- ftp 80 --- http 1718 21 or like this one: 20 --- 443 --- http 20/ 21 ---- ftp 21 ( I mean I need the duplicate values to be removed (or not detected) or values with "/" at the end which I have no idea about them!) can you give me some hint or the right regex I have to used to extract only open ports (once without considering duplicates at the rest)? I've even tried this one but still doesn't work properly... : rex max_match=10 "(?i) portid=\"(?P [^\"]+)"|rename FIELDNAME as OpenPorts|rex max_match=10 "(?im)^<\w+><\w+\s+\w+=\"(?P [^\"]+)" |rename FIELDNAME as status I think this is related to part after (os) or at least tell me what's the meanin of that part that repeats the result? or how can I ignore that part in my search? I'm waiting for any kind of help, Thanks in advance ... View more

Hey Guys, I have two different sourcetypes for my search, one of them is nmap.txt (which includes nmap trace s results from ports in our subnet among the whole 254 hosts, like Open/close Ports at different time sluts, OS version is running on target host and obviously on that IP Address) and the remedy.csv file (which includes data about IP addresses in subnet, details such the name of the user who has/had that IP address, DNS, is that IP free now or assigned, etc.) data example in remedy.csv: IP_Addr="121.180.254.114" User="Sina" Status="assigned" Name="sunvirt01.srv.be" (...) data example in nmap.txt: host starttime="1402600202" endtime="1402601288" status state="up" reason="echo-reply" reason_ttl="63" address addr="121.180.254.114" hostname name="sunvirt01.srv.be" type="PTR" hostnames ports extraports state="filtered" count="985" extrareasons reason="no-responses" count="985" extraports port protocol="tcp" portid="20" state state="Open" service name="ftp-data" port protocol="tcp" portid="443" state state="Open" port protocol="tcp" portid="60443" state state="closed" (...) what I need is a table like below, using these fields together, from two hosts. such this: IP----------------DNS-------------USER--------------Status(Free or not)--------------Ports(Open) 121.180.254.114 -- sunvirt01.srv.be -- Sina -- assigned -- 20,443 121.180.255.104 -- sunvirt03.srv.be -- Mat -- assigned -- 80,443 .... (I know it doesn't look so good here, but supposed to be in table format) p.s: just please notice that some fields with same value has different names in different sources and I just need the open ports (for example IP_Addr and DNS ) may anybody please help me with this? since I'm a beginner and not so professional with Splunk. Thanks in advance Cheers, ... View more