Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About jacqu3sy
jacqu3sy
Path Finder
Member since:
02-10-2017
12-11-2021
Community Statistics
| Posts | 143 |
| Solutions | 1 |
| Karma Given | 6 |
| Karma Received | 4 |
| Member Since | 02-10-2017 |
Activity Feed
- Posted Re: Chart including no results on Splunk Search. 01-20-2021 09:14 AM
- Posted Chart including no results on Splunk Search. 01-20-2021 08:10 AM
- Posted Re: Regex to extract fields between pipe on Splunk Enterprise. 12-11-2020 08:48 AM
- Posted Re: Regex to extract fields between pipe on Splunk Enterprise. 12-11-2020 07:01 AM
- Tagged Regex to extract fields between pipe on Splunk Enterprise. 12-11-2020 03:19 AM
- Posted Regex to extract fields between pipe on Splunk Enterprise. 12-11-2020 02:24 AM
- Karma Re: Regex file name after space for p_gurav. 06-05-2020 12:49 AM
- Karma Re: Regex file name after space for tiagofbmm. 06-05-2020 12:49 AM
- Got Karma for Suppress Notable Event during certain time slot. 06-05-2020 12:49 AM
- Karma Re: fill an occasional Null field with the current time for dineshraj9. 06-05-2020 12:48 AM
- Karma Re: IF then problems... for dineshraj9. 06-05-2020 12:48 AM
- Karma Re: IF then problems... for paulbannister. 06-05-2020 12:48 AM
- Got Karma for Is my search correctly using the bucket command in order to detect brute force attempts against multiple destinations?. 06-05-2020 12:48 AM
- Got Karma for Search a Splunk Enterpirse Security DataModel - problem with Wildcards. 06-05-2020 12:48 AM
- Got Karma for tstats and _time span. 06-05-2020 12:48 AM
- Karma Re: Can you create a dashboard with an adjustable time frame for searches? for jkshapiro. 06-05-2020 12:46 AM
- Posted Re: Regex for digits before .zip on Splunk Search. 04-01-2020 10:23 AM
- Posted Re: Regex for digits before .zip on Splunk Search. 04-01-2020 09:11 AM
- Posted Re: Regex for digits before .zip on Splunk Search. 04-01-2020 08:53 AM
- Posted Re: Regex for digits before .zip on Splunk Search. 04-01-2020 08:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-20-2021
08:10 AM
I'm trying to create a chart showing activity from May through until now, knowing that the activity ceased some months ago. I want the chart to continue showing a flat line of zero from the time the activity stopped, rather than just stopping back in August. How would I tweak the following query to include the ceased traffic? earliest=05/01/2020:00:00:01 latest=now index=nix sourcetype="nix" src_user=JohnD host=server1 | bin _time span=1w | stats count by _time, host Thanks.
... View more
12-11-2020
07:01 AM
So yeh, from well formed JSON, trying to run the query from a Search, where the Subject field is being extracted as expected. I tried your Regex and it didnt seem to like it. The first field should be the 1 after 'Subject :' and before the first pipe, the second field the message ID in between the first and second pipe etc. Whenever I tried doing it myself, it kept trying to grab the first character before any of the pipes, kinda ruining things!
... View more
12-11-2020
02:24 AM
Hi, I'm indexing events in JSON format and I need a way of extracting into individual fields the values broken up by the pipe in the 'Subject' field seen below; RecipientAddress: bla@bla.com SenderAddress: fred@fred.com Size: 201828 Status: FilteredAsSpam Subject: 1|fdbe21c9-xxxxx|195.168.1.1|Comms@fred.com|([Ext]Hi, join us for the 10-year roundup) 12/11/2020 8:21:14 AM ToIP: null I seem to be struggling to get a regex to work, not sure whether I need to take into account the JSON formatting? Thanks.
... View more
Labels
- Labels:
-
administration
04-01-2020
09:11 AM
Expected result is the full URL listed, but to only pull back URL's that match the regex, i.e. 10 digits followed by .zip
url=www.abcdef.com/1234532419.zip
... View more
04-01-2020
08:53 AM
ah yeh, how would I capture the whole URL though in the new data field? rather than just the 6 digits?
... View more
04-01-2020
08:53 AM
ah yeh, how would I capture the whole URL though in the new result field? rather than just the 6 digits?
... View more
04-01-2020
07:43 AM
Hi,
How do I write a regex to capture whenever I see any combination of 10 digits followed by .zip within a _raw event?
eg:
url=www.abcdef.com/1234532419.zip
Thanks.
... View more
03-10-2020
11:38 AM
Good spot. Sub search limitations. Its caught me out before and will do again I'm sure! If I switch the query around it works fine. Many thanks.
... View more
03-10-2020
09:49 AM
Anything wrong with this join and subsearch? I know there are events which should match based on the 'cs_host' field. Not sure if the rename is confusing things, or my syntax is off slightly.
index=aaa sourcetype=o365 "*phish URLs*"
| rename zu as cs_host
| join type=inner cs_host [ | search index=bbb sourcetype="proxy_logs" | fields *] | stats count by cs_host
Appreciate any ideas.
... View more
01-17-2020
04:45 AM
Hi,
Whats the correct syntax to use when trying to return results where two fields DO NOT match?
Trying the following, but not within any great success;
| where NOT match(field A, field B)
Thanks.
... View more
01-16-2020
04:39 AM
great stuff. Many thanks.
... View more
01-15-2020
08:32 AM
Kinda, but I want to list the results for each day within it's own row, if that makes sense.
So that is display better, in a table with a row for Monday, then alongside it listed the count by urgency.
... View more
01-15-2020
08:03 AM
Is it possible to take a distinct count of something, then list this by an additional value by day?
something like the following but tweaked to display the count of events, by urgency on specific days;
notable
| bucket _time span=1d
| stats dc(event_id) by urgency, _time
The goal being a table that looks like the following;
Monday Medium, 5
High, 7
Tuesday Low, 6
Medium, 10
High, 20
etc etc
Thanks.
... View more
12-23-2019
02:03 AM
Perfect. Many thanks. Have a great Xmas.
... View more
12-23-2019
01:15 AM
Is there a way to return a specific value if an event is seen between 18:00 and 07:00 the following day?
I need to generate a different value if something occurs overnight.
Was originally thinking of an eval with a > than, but then 02:00 would be less than 11pm so I'm confused as to whether it's possible!
Thanks.
... View more
12-16-2019
04:55 AM
Both these worked, many thanks, much appreciated.
... View more
12-16-2019
04:55 AM
appreciate the efforts, really do. Unfortunatly I couldnt get these to work, but thanks anyway.
... View more
12-16-2019
04:06 AM
Yeh, even with the second backslash I get an error when running straight from a search query, related to 'unmatched closing parenthesis'
<mysearch>
| rex "\\(?<filename>\w+\.\w+)$"
... View more
12-16-2019
03:56 AM
just straight from within a search
... View more
12-16-2019
03:56 AM
| rex "\(?\w+.\w+)$"
Error in 'rex' command: Encountered the following error while compiling the regex '(?\w+.\w+)$': Regex: unmatched closing parenthesis
... View more
12-16-2019
03:49 AM
hmmm, errors when I run that in Splunk though?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-11-2021
07:19 AM
|
Karma given to
