Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About johnhuang
johnhuang
Motivator
Member since:
07-10-2019
12-05-2023
Community Statistics
| Posts | 372 |
| Solutions | 76 |
| Karma Given | 70 |
| Karma Received | 126 |
| Member Since | 07-10-2019 |
Activity Feed
- Got Karma for Re: mvexpand multiple multi-value fields?. 08-29-2023 05:49 AM
- Posted Re: How can I adjust the query to include total connections that are initiated out of the country? on Splunk Enterprise. 04-13-2023 10:40 AM
- Posted Re: Need Help with Query Involving Countries on Splunk Enterprise. 04-13-2023 08:23 AM
- Got Karma for Re: Metadata fields license consumption. 04-13-2023 08:12 AM
- Posted Re: Metadata fields license consumption on Getting Data In. 04-13-2023 08:08 AM
- Karma Re: Metadata fields license consumption for mattymo. 04-13-2023 07:53 AM
- Posted Does the length of metadata fields and its value, host, source, and sourcetype count against license consumption? on Getting Data In. 04-12-2023 07:41 PM
- Got Karma for Re: Who Added User X to a Specific AD Security Group?. 12-09-2022 01:11 PM
- Posted Re: Who Added User X to a Specific AD Security Group? on Splunk Enterprise. 12-09-2022 12:53 PM
- Posted Re: Replace a nested field on Splunk Search. 11-16-2022 02:29 PM
- Got Karma for Re: Trouble extracting GUIDS and how to make a new field with rex?. 11-16-2022 10:36 AM
- Karma Re: Group events based on content of field for FrankVl. 11-16-2022 10:23 AM
- Posted Re: How to split single column into muliple columns and place them as adjecent colums? on Deployment Architecture. 11-16-2022 10:10 AM
- Karma Re: Trouble extracting GUIDS and how to make a new field with rex? for richgalloway. 11-16-2022 09:48 AM
- Posted Re: Trouble extracting GUIDS and how to make a new field with rex? on Splunk Search. 11-16-2022 09:47 AM
- Karma Re: ISO 8601 TimeStamp Extraction / Formatting and Source Type Config for DGilbert91. 11-16-2022 09:03 AM
- Got Karma for Re: How can I customize color for cell value based on condition?. 11-10-2022 09:56 PM
- Got Karma for Re: How to split a column into two based on condition?. 11-10-2022 11:13 AM
- Posted Re: EVAL tag in simple XML with replace regular expressions OR variable with multiple values to be used in the main sear on Dashboards & Visualizations. 11-10-2022 10:12 AM
- Posted Re: Help joining two different sourcetypes from the same index that both have a field with the same value but different on Splunk Search. 11-10-2022 09:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-13-2023
10:40 AM
Add this after the ip location line: | search NOT Country="United States" If want to exclude a list of Countries: | search NOT Country IN ("United States", "United Kingdom", "France")
... View more
04-13-2023
08:23 AM
There's a few ways to break it down by users. You can try: index=company_logs "Client Type: Cisco AnyConnect VPN Agent"
| iplocation src
| stats dc(src) BY Country Cisco_ASA_user
index=company_logs "Client Type: Cisco AnyConnect VPN Agent"
| iplocation src
| chart dc(src) BY Cisco_ASA_user Country
index=company_logs "Client Type: Cisco AnyConnect VPN Agent"
| iplocation src
| stats dc(src) values(Cisco_ASA_user) AS Cisco_ASA_user BY Country
... View more
04-13-2023
08:08 AM
1 Karma
Thank you @mattymo, I was able to test and confirm your answer. The following event sent to HEC would incur license usage of 22 bytes. {
"index":"summary_is_temp",
"host":"testing_hec_license_consumption.acme.org",
"source":"/var/logs/application_monitoring.log",
"sourcetype":"application_status",
"event":{
"message":"Seems OK"
}
}
... View more
04-12-2023
07:41 PM
Does the length of metadata fields and its value such as time, host, source and sourcetype count against license consumption? For example, the following HEC JSON has a length of 212 characters but the event (_raw) is only 20 characters, is license calculated against the total json length or _raw length?
{
"time":1437522387,
"host":"dataserver01.applicationmonitoring.com",
"source":"/var/logs/application_monitoring.log",
"sourcetype":"application_status",
"event":{
"message":"Seems OK"
}
}
... View more
Labels
- Labels:
-
source
-
sourcetype
12-09-2022
12:53 PM
1 Karma
source=WinEventLog:Security EventCode IN (4728, 4732, 4746, 4751, 4756, 4761, 4729, 4733, 4747, 4752, 4757, 4762, 4786, 4788) earliest=-7d@d
| eval changed_by=mvindex(Security_ID, 0)
| eval member_id=mvindex(Security_ID, 1)
| eval group_id=mvindex(Security_ID, 2)
| rex "A member was (?<change_type>(added|removed))"
| eval host_name=coalesce(src_nt_host, dvc_nt_host, host)
| rename EventCode as event_code EventCodeDescription AS event_desc
| table _time host_name changed_by change_type group_id member_id event_code event_desc
... View more
11-16-2022
02:29 PM
Splunk doesn't like fieldnames with special characters like periods. | rename properties.url AS endpoint
| rex field=endpoint mode=sed "s/\/\d+\//\/{id}\//"
... View more
11-16-2022
10:10 AM
| eval Count=LOWER(Count)
| fillnull value="0m" Count
| eval {Year}=Quarter." ".Count
| stats max(20*) AS 20* BY Quarter
| sort -Quarter
| table 20* With test data: | makeresults | eval data="2021,Q4,2m;2021,Q3,1m;2021,Q2,2m;2021,Q1,;2022,Q4,5m;2022,Q3,7m;2022,Q2,8m;2022,Q1,5m"
| eval data=split(data, ";") | mvexpand data
| rex field=data "(?<Year>\d+)\,(?<Quarter>\w+)\,(?<Count>\w+)?"
| table Year Quarter Count
| eval Count=LOWER(Count)
| fillnull value="0m" Count
| eval {Year}=Quarter." ".Count
| stats max(20*) AS 20* BY Quarter
| sort -Quarter
| table 20*
... View more
11-16-2022
09:47 AM
1 Karma
If you want to extract all guids after "fieldx": | rex max_match=0 "(\'fieldx\':\s)?(?<fieldx_guids>\w{8}\-\w{4}-\w{4}-\w{4}-\w{12})(?:\,\s|\")" If you want to extract all guids in the data: | rex max_match=0 "(?<guids>\w{8}\-\w{4}-\w{4}-\w{4}-\w{12})"
... View more
11-10-2022
10:12 AM
Try this: <eval token="exclude_uri">"NOT cs_uri_sterm IN (\\\"".replace(trim($exclude$),"\\s+","\\\", \\\"")."\\\")"</eval>
... View more
11-10-2022
09:48 AM
You should create a lookup for the vulnerability definition -- you can adjust the fields to save into the lookup as necessary. First create the initial lookup: index=rapid7 sourcetype="rapid7:insightvm:vulnerability_definition" earliest=-7d@d
| dedup id
| fields id added categories cves cvss_v2_access_complexity cvss_v2_access_vector cvss_v2_authentication cvss_v2_availability_impact cvss_v2_confidentiality_impact cvss_v2_exploit_score cvss_v2_impact_score cvss_v2_integrity_impact cvss_v2_score cvss_v2_vector cvss_v3_attack_complexity cvss_v3_attack_vector cvss_v3_availability_impact cvss_v3_confidentiality_impact cvss_v3_exploit_score cvss_v3_impact_score cvss_v3_integrity_impact cvss_v3_privileges_required cvss_v3_scope cvss_v3_score cvss_v3_user_interaction cvss_v3_vector denial_of_service description links modified pci_cvss_score pci_fail pci_severity_score pci_status published references risk_score severity severity_score title
| rename id AS vulnerability_id
| table vulnerability_id categories title description cves cvss_v2_score cvss_v3_score pci_cvss_score severity severity_score added modified
| outputlookup rapid_vulnerability_definition_lookup.csv To keep the lookup up to date, schedule a report (daily or as often as you need) index=rapid7 sourcetype="rapid7:insightvm:vulnerability_definition" earliest=-1d@d
| rename id AS vulnerability_id
| append [| inputlookup rapid_vulnerability_definition_lookup.csv]
| dedup vulnerability_id
| table vulnerability_id categories title description cves cvss_v2_score cvss_v3_score pci_cvss_score severity severity_score added modified
| outputlookup rapid_vulnerability_definition_lookup.csv To use the lookup: index=rapid7 sourcetype="rapid7:insightvm:asset:vulnerability_finding" finding_status=new
| eval date=strftime(now(),"%m-%d")
| eval date=strftime(now(),"%m-%d")
| eval date_first=substr(first_found,6,5)
| where date=date_first
| lookup rapid_vulnerability_definition_lookup.csv vulnerability_id OUTPUT title description
... View more
11-10-2022
09:21 AM
1 Karma
This should match your output. | makeresults
| eval data="11/8,Apple,X,3;11/8,Apple,Y,10;11/8,Apple,X,3;11/8,Apple,Y,10;11/8,Orange,Y,6;11/8,Orange,X,1;11/8,Orange,Y,6;11/9,Apple,X,0;11/9,Apple,Y,9;11/9,Apple,X,0;11/9,Orange,X,7;11/9,Orange,Y,2"
| eval data=split(data, ";")
| mvexpand data
| rex field=data "(?<Date>[^,]*)\,(?<Fruit>[^,]*)\,(?<Seller>[^,]*)\,(?<Bad_count>[^,]*)"
| table Date Fruit Seller Bad_count
| eval {Seller}_bad_count=Bad_count
| eventstats max(*_bad_count) AS *_bad_count BY Date Fruit
| table Date Fruit Seller Bad_count *_bad_count
... View more
11-10-2022
08:48 AM
Your table layout example is not clear. Does the dashes between the field values represent artificial delimiters or is it part of the value?
... View more
11-10-2022
08:36 AM
Are the fieldnames Date, Fruit, Seller, Bad_count? Could you provide a sample of your data (screenshot)?
... View more
11-10-2022
08:04 AM
Try something like this. You have to manually select the column chart and format the X-Axis Label to rotate vertically. <base_search>
| timechart span=1d count
| eval date=strftime(_time, "%Y-%m-%d")
| table date count
... View more
11-10-2022
07:51 AM
Keep in mind that =@d is a short way of expressing =-0d@d. As best practice, I recommend you use =-0d@d. earliest=-1d@d+7h latest=-1d@d+19h
... View more
11-10-2022
07:43 AM
Assuming your fieldnames are: Date, Fruit, Seller, Bad_count | eval {Seller}_bad_count=Bad_count
| eventstats sum(*_bad_count) AS *_bad_count BY Date
| table Date Fruit Seller Bad_count *_bad_count
... View more
11-08-2022
03:14 PM
Combine the multivalued fields, take a count, then dedup and count again. If the count goes down after deduping, you have a match. <base_search>
| eval id_combined=MVAPPEND(ID1, ID2)
| eval id_ct=MVCOUNT(id_combined)
| eval id_combined=MVDEDUP(id_combined)
| eval id_dc=MVCOUNT(id_combined)
| eval match=IF(id_ct>id_dc, "TRUE", "FALSE")
... View more
11-08-2022
11:02 AM
Could you provide a sample query and data that you're using?
... View more
11-08-2022
06:46 AM
Could you expand the userAction field?
... View more
11-08-2022
06:36 AM
1 Karma
One of these could work: index="my index" sourcetype="my sourcetype" action="heartbeatfailure"
| bucket _time span=1d
| eventstats count BY _time host action
| table _time host action failure_reason count
| where count>2 index="my index" sourcetype="my sourcetype" action="heartbeatfailure"
| bucket _time span=1d
| stats count values(failure_reason) AS failure_reason BY _time host action
| table _time host action failure_reason count
| where count>2
... View more
11-07-2022
06:00 PM
Assuming that Ing values are always formatted as a phone number: | rex field=Logs "\"(?<ing_values>\d\-\d{3}\-\d+)\""
| eval ing_6=MVINDEX(ing_values, 6)
... View more
11-07-2022
05:51 PM
Yes you could do that.
... View more
11-07-2022
08:06 AM
You can do the lookup twice. Either of these should work: | lookup lookup_name host AS host OUTPUT app AS app_1 owner AS owner_1
| lookup lookup_name ip AS host OUTPUT app AS app_2 owner AS owner_2
| eval app=COALESCE(app_1, app_2)
| eval owner=COALESCE(owner_1, owner_2) | lookup lookup_name host AS host OUTPUTNEW app owner
| lookup lookup_name ip AS host OUTPUTNEW app owner
... View more
11-04-2022
02:49 PM
You can do this with schedule report or alert. As long as you have an outputlookup in the query, it should update the lookup.
... View more
11-04-2022
02:47 PM
Could you provide a sample an event or string that meets your criteria?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-05-2023
01:40 PM
|
Karma given to
