About numeroinconnu12

numeroinconnu12 · ‎06-29-2023

Hello, Hope you are well I want to etract only TP58304 on this line (8)TP58304 (5)endra(3)ttx(5)local(0) How can i do please? Thanks

numeroinconnu12 · ‎04-06-2023

it's work, thank you @gcusello 🙂

numeroinconnu12 · ‎04-06-2023

Hello, thank you in advance for your feedback. I would like to sort the date so that my graph is coherent, can you please help me? | tstats summariesonly=t allow_old_summaries=t count from datamodel=Authentication.Authentication where [| inputlookup ****.csv | eval host=Machine | table host ] AND NOT Authentication.src_user="*$" AND NOT Authentication.src_user="unknown" by host,Authentication.src,Authentication.src_user,_time | eval host=upper(host) | eval Serveur='Authentication.src' | eval **** = upper(trim(('Authentication.src_user'))) | eval samaccountname=substr(trim(upper('Authentication.src_user')),1,7) | eval domaine="****" | lookup **** samaccountname as samaccountname domaine as domaine | search email="*" | eval **** = samaccountname | table ****, ****, host, email,ua,cn,_time,cn | join host type=left [| inputlookup *****.csv | eval host=Machine] | where Ferme="****" OR Ferme="****" OR Ferme="*****" OR Ferme="*****" OR Ferme="****" | stats values(Ferme) as Ferme values(_time) as _time by *****,cn | eval Date=strptime(_time,"%d/%m/%Y") | sort Date | eval Date=strftime(_time,"%d/%m/%Y") | stats count as "nb. de connexion par jour" by Ferme,Date

numeroinconnu12 · ‎01-20-2023

thank you very much, it's works@richgalloway

numeroinconnu12 · ‎01-19-2023

Hello and happy new year to all, As the title says I would like to have the list of servers that have connected over the last 14 days (Lastlogon)... I have tried several methods but nothing works, here is my query : index=msad SamAccountName=*$ VersionOS="Windows Server*" | eval llt=strptime(LastLogon,"%d/%m/%Y %H:%M:%S") | eval LastLogon2=strftime(llt, "%d/%m/%Y %H:%M:%S") | rex field=SamAccountName mode=sed "s/\$//g" | table Domain,SamAccountName,VersionOS,LastLogon2 Thanks

numeroinconnu12 · ‎04-28-2022

Hello, Thank you very much for the answer but it doesn't work. I would like to extract only GRP_Basic or GRP_Hash thank you

numeroinconnu12 · ‎04-28-2022

Good evening, Thank you all for your support, I have a field called Memberof which contains the following data per line. 1) cn=GRP_Basic,ou=Users,dc=admin,dc=spike|cn=GRP_Hash,ou=Groups,dc=admin,dc=spike 2) cn=GRP_ADC,ou=Groups,dc=admin,dc=spike|cn=GRP_Vabd_Admin,dc=admin,dc=spike|cn=GRP_Vabd_Supe 3) cn=GRP_sos,ou=Groups,dc=command,dc=spike I wanted to extract for each row all that starts with GRP For example for the first line I need to extract GRP_Basic and GRP_Hash For the second line I have to extract GRP_ADC and GRP_Vabd_Admin and GRP_Vabd_Supe thank you very much

numeroinconnu12 · ‎01-13-2022

Hello @ITWhisperer , thanks foy your answer for more information: query 1: index=active_directory | stats count by cn |rename cn as name Results: name test test1 test2 test3 query 2: index=cabod | stats count by name Results name test1 test2 So I would like a query that shows me what is present in the results of query 1 but not in the results of query 2. in this case test, test3

numeroinconnu12 · ‎01-13-2022

Hello, Thank you in advance for your help. I have a query that returns results containing a list of names and another query that also returns a list containing names. I would like to make a report indicating the names present in the first query but not present in the second query (delta of both queries)

numeroinconnu12 · ‎11-30-2021

Thank you @ITWhisperer it's work.

numeroinconnu12 · ‎11-30-2021

Morning, everyone, Thank you in advance for your help. I would like to remove a part of a character from my results. My query results look like this: j2874a8B$ I'd like to delete the $ to get it: j2874a8B How do I proceed? Thank you very much.

numeroinconnu12 · ‎10-20-2021

Thank you @PickleRick my correction, it's work index=antivirus | eval lmt=strptime(LastMessageTime,"%m/%d/%Y %H:%M:%S") | eval lst=strptime(LastScanDateTime,"%m/%d/%Y %H:%M:%S") | stats values(SAVVersion) as SAVVersion, values(EngineVersion) as EngineVersion ,values(VirusDataVersion) as VirusDataVersion, max(lmt) as LastMessageTime, max(lst) as LastScanDateTime by Name | sort LastScanDateTime | eval diff=round((Now() - LastScanDateTime)/60/60/24) | eval "active in the last 7 days ?"=if(round((Now() - LastMessageTime)/60/60/24)>7,"NO","YES") | eval LastMessageTime=strftime(LastMessageTime,"%d/%m/%Y %H:%M:%S") | eval LastScanDateTime=strftime(LastScanDateTime,"%d/%m/%Y %H:%M:%S") | where (diff > 3) OR isnull(diff) | fillnull value="-" | sort - "active in the last 7 days?" - diff

numeroinconnu12 · ‎10-20-2021

Hello, This is my request: index=antivirus | stats values(SAVVersion) as SAVVersion, values(EngineVersion) as EngineVersion ,values(VirusDataVersion) as VirusDataVersion, max(LastMessageTime) as LastMessageTime, max(LastScanDateTime) as LastScanDateTime by Name | sort LastScanDateTime | eval diff=round((Now() - LastScanDateTime)/60/60/24) | eval "active the last seven days ?"=if(round((Now() - LastMessageTime)/60/60/24)>7,"NO","YES") | where (diff > 3) OR isnull(diff) | fillnull value="-" | sort - "active the last seven days ?" - diff I would like to have only the PCs(Name) not scanned (LastScanDateTime) for more than three days, but my request does not work, it returns all the PCs. Can you please help me? sorry for my english

numeroinconnu12 · ‎06-02-2021

Thanks @ITWhisperer

numeroinconnu12 · ‎06-01-2021

Hello everyone, thanks for your helping. How to use the CRON SCHEDULE to schedule a splunk report once a quarter but on the first day of the month. For example for January, February, March, the report will be scheduled for January 1st. For March, April, May, the report will be scheduled for March 1st ....

numeroinconnu12 · ‎07-20-2020

Hello everyone, I have a splunk query that returns the connection ranges with the start and end of the connection. Below is an example. user DateMin DateMax 1234 2020-07-14 04:54:21 2020-07-14 06:02:54 I would just like to display connections that last at least 6 minutes. Thanks.

numeroinconnu12 · ‎06-15-2020

Thank you @bowesmana it works.

numeroinconnu12 · ‎06-15-2020

Morning, everyone, Thank you in advance for your help. I would like to remove a part of a character from my results. My query results look like this: TRERY\j2874ac TRERY\k5846de I'd like to delete the "TRERY\" to get it: j2874ac k5846de How do I proceed? Thank you very much.

numeroinconnu12 · ‎04-20-2020

Thank you @PavelP it works

numeroinconnu12 · ‎04-14-2020

Thank you. But I copied it wrong, otherwise I have three *** in my expression cron What happens is I get one alert per hour with normal authentication data. What I want is just the logins between 8:00 pm and 7:00 a.m.

numeroinconnu12 · ‎04-14-2020

Hello, I have a query that controls authentication to an application. It is forbidden to connect to the application from 8:00 pm to 7:00 am unless necessary. i want to do alert when i have connections from 8:00 pm to 7:00 am. i use cron: 00 20,21,22,23,0,1,2,3,4,5,6,7 * * * but it's not work. can you help me please? thanks

numeroinconnu12 · ‎04-14-2020

Thanks you all, it works

numeroinconnu12 · ‎04-14-2020

Hello, This is my character string user=YHYIFLP@intra.bcg.local i want to display just YHYIFLP, i use | eval user=trim(user, "@intra.bcg.local") he doesn't work verry well. it's possible to use regex? Thanks.

numeroinconnu12 · ‎03-12-2020

No answer ? :'(

numeroinconnu12 · ‎03-11-2020

Hello, This is my query with " dedup Matricule" index=juniper_vpn (ID=AUT22673 OR ID=AUT24803) ......67 | eval src_user=upper(src_user) | join type=left user [| _accounts.csv |search domaine="intra"| eval user=matricule ] | join type=left ua [|_dirigeant.csv | eval ua=UA ] | rename user as Matricule, cn as Nom, ua as UA | dedup Matricule | stats min(_time) as Firstdate max(_time) as Lastdate list(Nom) as Nom list(UA) as UA list(Matricule) as Matricule by src_user | convert timeformat="%d/%m/%Y %H:%M:%S" ctime(Firstdate) AS Firstdate, ctime(Lastdate) AS Lastdate | eval Date=if(Firstdate = Lastdate,"le ".Firstdate,"connecté entre le ".Firstdate." et le ".Lastdate) | stats count(Matricule) as "Total" list(Nom) as Nom list(Date) as "Date et heure de connexion" list(src_user) as Utilisateur by UA | table UA Nom Utilisateur "Date et heure de connexion" "Total" | addcoltotals labelfield=UA label="nombre total d'utilisateurs" "Total" you can see the results in the screenshot below. The results in the column "Date et heure de connexion" are not correct. But if I delete "dedup Matricule" from my query, the results obtained in the column "Date et heure de connexion" are correct but they are many as you can see on the second screenshot. How can I get only one value in the "Date et heure de connexion" column without dedup? Can you please help me?

Posts	45
Solutions	2
Karma Given	1
Karma Received	1
Member Since	‎11-13-2019

Online Status	Offline
Date Last Visited	‎06-29-2023 08:05 AM

How can I extract with Regex?

How to to sort the date so that my graph is cohere...

How to search in active directory for servers conn...

Help with fields extraction

splunk query

Remove $ (dollar) characters in field results

PCs not scanned for more than 3 days

cron expression scheduled report

filter data

remove characters in field results

How can I extract with Regex?

Re: sorting date

How to to sort the date so that my graph is cohere...

Re: How to search in active directory for servers ...

How to search in active directory for servers conn...

Re: fields extraction

Help with fields extraction

Re: splunk query

splunk query

Re: Remove $ (dollar) characters in field results

Remove $ (dollar) characters in field results

Re: PCs not scanned for more than 3 days

PCs not scanned for more than 3 days

Re: cron expression scheduled report

cron expression scheduled report

filter data

Re: remove characters in field results

remove characters in field results

Re: Alerting cron Query

Re: Alerting cron Query

Alerting cron Query

Re: regex to extract field

regex to extract field

Re: dedup problem

dedup problem