×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Daniel_K
Explorer
Member since: ‎09-17-2019
‎03-21-2022
Community Statistics
Posts 7
Solutions 0
Karma Given 4
Karma Received 2
Member Since ‎09-17-2019
Activity Feed
View All

Re: Group DNS queries per src_ip where two domains...

by in Splunk Search
‎03-21-2022 06:49 AM
‎03-21-2022 06:49 AM
Yes, you're correct and  I was unclear. I wanted the result to be whenever the 2 different domains where queried within a specific time frame. Your suggestion was great and @ITWhisperer tweaked it a bit more to satisfy the needs.  I still think the search could be improve by: * Group based on src_ip with only one line with the different domains within the time frame * If any query as it is now gives more than one hit - the result will be wrong, right? 🙂   ... View more

Re: Group DNS queries per src_ip where two domains...

by in Splunk Search
‎03-21-2022 05:12 AM
‎03-21-2022 05:12 AM
Thanks Giuseppe! That search worked just fine but if you help me even more it would be great. Let's assume that both queries must be within X minutes of time but the complete query time is earliest=Y and latest=Z. 🙂 ... View more

Group DNS queries per src_ip where two domains are...

by in Splunk Search
‎03-21-2022 03:48 AM
‎03-21-2022 03:48 AM
Hi experts, I would appreciate some design help with a query where I want to see all src_ip's querying for two different domains within X minutes of time interval during a longer time period. 🙂       ... View more

ESCU - Minor issue with ESCU - Detect Prohibited A...

by in All Apps and Add-ons
‎06-22-2020 10:56 PM
‎06-22-2020 10:56 PM
Found a minor issue with the ESCU search "ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule" Advanced Edit -> Rename "parent_process" to be "parent_process_name" to get the parent name in the "Incident Review" Tab.  ESCU version 1.0.49       ... View more
Labels

Re: Major Problem with Cisco ASA Add on

by in All Apps and Add-ons
‎02-28-2020 06:32 AM
1 Karma
‎02-28-2020 06:32 AM
1 Karma
Anyone know if this is fixed in 3.4.0? ... View more

Re: Excessive DNS Queries - Whitelist?

by in Splunk Enterprise Security
‎11-22-2019 05:17 AM
‎11-22-2019 05:17 AM
327 views but no answer. We welcome an answer. 🙂 ... View more

Still supported to deploy latest Sysmon 10.x versi...

by in All Apps and Add-ons
‎11-04-2019 03:46 AM
1 Karma
‎11-04-2019 03:46 AM
1 Karma
Hi Olaf, Looking into to use "Sysmon deploy and maintain" to deploy latest Sysmon 10.x version. Should this work flawless or are any issues to be expected? Best Regards, Daniel ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎03-21-2022 11:41 AM
Karma from
View All
Karma given to
View All