About mbenitezr

mbenitezr · ‎07-08-2015

Hi. i know this is a old topic, but i want to now, do you found a good solution? thanks.

mbenitezr · ‎03-27-2015

thanks a lot

mbenitezr · ‎03-27-2015

you just have change typesource for sourcetype

mbenitezr · ‎03-24-2015

it is not working well, i want to search the process was killed in typesouce ps, but i can't do it

mbenitezr · ‎03-24-2015

hello again, I have this: (sourcetype=ps) | search [search bash_command=kill* | rex field=bash_command "kill (?.+[0-9])" | dedup PID |fields PID ] But don't work, i now i need split PID, but, i want first somo data thanks a lot to rob_jordan and masonmorales

mbenitezr · ‎03-19-2015

Hi I want to search the command "kill" on source bash_command=kill* and search the process from sourcetype=ps Thanks a lot.

Posts	6
Solutions	0
Karma Given	9
Karma Received	0
Member Since	‎03-19-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Can I run another search based on the results of a...

Re: Updating Remote Forwarders

Re: Can I run another search based on the results ...

Re: Can I run another search based on the results ...

Re: Can I run another search based on the results ...

Re: Can I run another search based on the results ...

Can I run another search based on the results of a...