About verifi81

verifi81 · ‎03-04-2022

Howdy folks This is my field: ABC_Account_Name I want to exclude these values: mcas* gmcas* I know I can do it this way: ABC_Account_Name!=mcas ABC_Account_Name!=gmcas how do I combine them into one so that I have 1 exclusion that covers both values?

verifi81 · ‎02-17-2022

I'm just looking for a link to research. Not HOW to do it.

verifi81 · ‎02-17-2022

I would like to create a dashboard that has field inputs so that I can share with end users who are not familiar with spunk. I just want them to present two fields that they can just provide the input like an IP address and click GO and will get the results back of my particular search query. If that's possible, what do I have to look into? Helpful if I can get a link as well. Thank you in advance.

verifi81 · ‎08-12-2021

I have this SPL index="_internal" fwdType=uf | dedup hostname | table hostname I want to create a macro called uf I have the macro created like this: I want to be able to just execute this macro in search but it doesn't look the same as if I execute the full command. What am I doing wrong?

verifi81 · ‎07-25-2021

Hello friends, Suppose I install Microsoft Sysmon on a Windows server. I then go install the Universal Forwarder on the Windows server with the default settings. A deployment server is in the mix too if that matters. My question is this. Will the Universal Forwarder know to pick up the Syslog events if using all default settings? Is that defined on the Deployment server?

verifi81 · ‎06-24-2021

Hi folks I have a windows deployment server on prem. I have 20 windows servers for which I installed the Universal Forwarder and pointed it to the deployment server over port 8089. Where within the deployment server can I confirm that the 20 windows servers are all reporting in?

verifi81 · ‎05-26-2021

I got it. I had to do it this way (OldObjectDN=*"OU=Rad Users"*) OR (OldObjectDN=*"OU=Fad Users"*) I appreciate the help from both of you.

verifi81 · ‎05-26-2021

Sure. Suppose I have this: Field: OldObjectDN Possible values: OU=Rad Users OU=Fad Users OU=Sad Users OU=Bad Users OU=Mad Users I only want the search to return events only if OldobjectDN has the values for Rad User OR Fad Users

verifi81 · ‎05-25-2021

Yuanliu, I'm trying to include either values but not both values.

verifi81 · ‎05-25-2021

Because the value "Sad Users" is being returned as well. Trying to only return these values: Rad Users Fad Users

verifi81 · ‎05-25-2021

HI Soutamo, If I use your suggestion I get other values of the oldobjectDN that don't match "Rad Users" or "Fad Users". I want the search result to ONLY give me events when the OldObjectDN contains either of those two values.

verifi81 · ‎05-25-2021

Hi everyone. I'm trying to get this query going with one search but I can't seem to do that. I can only get it to work when I separate into two queries. Here are the two queries. Query1: index=wineventlog NewObjectDN="*OU=blue*" OldObjectDN=*"Rad Users"* signature_id=4147 Query2: index=wineventlog NewObjectDN="*OU=blue*" OldObjectDN=*"Fad Users"* signature_id=4147 the Field OldObjectDN has multiple values I'm trying to combine into one search. What would the proper syntax be?

verifi81 · ‎05-14-2021

Thank you very much for taking the time to explain this to me.

verifi81 · ‎05-11-2021

I figured it out. This will give me what I want | eval Username2 = split(Username, " ") | eval Username2 = mvindex(Username2, 0) . "." . mvjoin(mvindex(Username2,1,-1),"") This is very complex. Would you be kind enough to provide me a link that you would recommend a novice to study so that I can understand every aspect of the above command?

verifi81 · ‎05-11-2021

Javiergn, thank you so much. I forgot to add a . What would I add to that to make the results look like this: Username2 Bob.MarleyPeter Sammy.DolphinGreen Larry.MacyJr

verifi81 · ‎05-11-2021

Hi I have a search that his the Field of Username and 3 sample values Username Bob Marley Peter, Sammy Dolphin Green, Larry Macy Jr, I need help with the rex syntax that keeps the first and middle name separate, but joins the middle and last name while dropping the apostophe In essence, i want the end result to be like this: Username2 Bob MarleyPeter Sammy DolphinGreen Larry MacyJr Please help correct this syntax: | rex field=blah "(?i)username=(?<username2>[^,]+) | table username2

verifi81 · ‎05-07-2021

Hi Splunk Gurus, I would like to know if this is possible. Scenario: I have a webhook alert named Onboarding The output of that search has a field called Usernames1 which has 1000 entries. I want to set up a new Alert called Leaving and it will have it's own search which outputs another set data into a field called Usernames2 My problem: I want the Alert Leaving to compare it's field Username2 to Alert Onboarding field Usernames1 AND if there is a match, output the matching results to new field called match A bit on the complex side but can that be done? Please help with syntax.

verifi81 · ‎04-29-2021

I stand corrected. It worked. Thank you!

verifi81 · ‎04-29-2021

Hello Kamlesh, My list of username is 1000 entries long so I won't be able to specify it like that.

verifi81 · ‎04-28-2021

Hi folks I'm providing a sample of many values I have for field: username Field: username Value: Roger Smith Bob Dole Randy Savage I'm trying to create another field with the EVAL command called EMAIL and placing a dot between first name and last name followed by @falcon.com Basically I'm trying to get the new field like this. Field: Email Roger.Smith@falcon.com Bob.Dole@falcon.com Randy.Savage@falcon.com What would the syntax be? Thanks in advance

verifi81 · ‎04-28-2021

Perfect. thank you so much.

verifi81 · ‎04-28-2021

ITWhisperer, thank you so much. In some cases the CN is lower case so it doesn't match for those entries. Is there a way to make this case insensitive?

verifi81 · ‎04-26-2021

I don't know why the question cut off. My question is, if I wanted just the CN portion of the results to display in a separate column called "NAMES", how can I do that?

verifi81 · ‎04-26-2021

Hello folks I have a search in which I table. Here is a snippet of the results ObjectDN _time cn=Jane Fonda,OU=Blue,OU=Pad,OU=Circle Team,DC=circle,DC=net 2021-04-22 23:48:36 CN=Matt Cruz,OU=Blue,OU=Pad2,OU=Circle Team,DC=circle,DC=net 2021-04-22 01:07:43 If I want to extract the names contained in the CN to output to a column on it's own how would I do that?

verifi81 · ‎03-30-2021

Hello folks, I have about 20 hosts that fall under index=devices I need a query that will display the count information for each host, once over a 24 hour period. My intention is to use this to set an alert so that if a host does not have any count in 24 hours, it will send an alert. What query would work best for this?

Posts	50
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎06-19-2020

Online Status	Offline
Date Last Visited	‎03-07-2022 12:27 PM

How to combine values into one so that there is 1 ...

How to create a dashboard that has field inputs so...

Splunk Macro

Heavy forwarder and sysmon

splunk deployment server

Splunk query - multiple values from a field

rex syntax help

new search - that will correlate against another s...

concatenate syntax

Extract value from a field

How to combine values into one so that there is 1 ...

Re: How to create a dashboard that has field input...

How to create a dashboard that has field inputs so...

Splunk Macro

Heavy forwarder and sysmon

splunk deployment server

Re: Splunk query - multiple values from a field

Re: Splunk query - multiple values from a field

Re: Splunk query - multiple values from a field

Re: Splunk query - multiple values from a field

Re: Splunk query - multiple values from a field

Splunk query - multiple values from a field

Re: rex syntax help

Re: rex syntax help

Re: rex syntax help

rex syntax help

new search - that will correlate against another s...

Re: concatenate syntax

Re: concatenate syntax

concatenate syntax

Re: Extract value from a field

Re: Extract value from a field

Re: Extract value from a field

Extract value from a field

Searching all hosts in an index for count