Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About byeb1264
byeb1264
Explorer
Member since:
07-06-2020
08-11-2020
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 07-06-2020 |
Activity Feed
- Posted Re: Nullqueue not working on Getting Data In. 08-11-2020 05:09 AM
- Posted Re: Module 4 lab fundamentals using Splunk Cloud on Getting Data In. 08-07-2020 01:57 PM
- Posted Re: Nullqueue not working on Getting Data In. 08-07-2020 01:50 PM
- Posted Re: Nullqueue not working on Getting Data In. 08-07-2020 11:45 AM
- Posted Nullqueue not working on Getting Data In. 08-07-2020 11:08 AM
- Got Karma for How to get SPL to exclude results that do not contain a string in multiple fields?. 07-07-2020 09:55 PM
- Karma Re: How to get SPL to exclude results that do not contain a string in multiple fields? for bowesmana. 07-06-2020 05:58 PM
- Posted Re: How to get SPL to exclude results that do not contain a string in multiple fields? on Splunk Search. 07-06-2020 05:57 PM
- Posted How to get SPL to exclude results that do not contain a string in multiple fields? on Splunk Search. 07-06-2020 11:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 |
08-11-2020
05:09 AM
So now I have the line break and stanza correct as the events are finally being broken properly. The regex to send some of the events to nullqueue is still failing. I will post a sample of an event I want to go to nullqueu and see if anyone knows a regex that will catch the event and send it to nullqueue. I will also re-post my current stanzas. props.conf [cs_replicator] TRANSFORMS-CS = EliminateCS2 TRANSFORMS-CS = EliminateCS1 KV_MODE = json LINE_BREAKER = (){ SHOULD_LINEMERGE = false NO_BINARY_CHECK = false category = Structured description = JavaScript Object Notation format. For more information, visit http://json.org/ disabled = false TIME_PREFIX="timestamp":" TIME_FORMAT = %s%3N TZ=UTC pulldown_type = 1 transforms.conf [EliminateCS1] REGEX = event_simpleName!=EndOfProcess DEST_Key = queue FORMAT = nullQueue [EliminateCS2] REGEX = event_simpleName!=ProcessRollup2 DEST_Key = queue FORMAT = nullQueue Sample raw event: {"ProcessCreateFlags":"67109888","IntegrityLevel":"16384","ParentProcessId":"33794688676116","SourceProcessId":"33794688676116","aip":"97.78.178.74","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-18","event_platform":"Win","TokenType":"1","ProcessEndTime":"","ParentBaseFileName":"btool.exe","ImageSubsystem":"3","id":"c3385391-dbc9-11ea-a5c6-0266311e7407","EffectiveTransmissionClass":"3","SessionId":"0","Tags":"27, 29, 40, 53, 54, 12094627905582","timestamp":"1597147019837","event_simpleName":"ProcessRollup2","RawProcessId":"6140","ConfigStateHash":"2029599784","MD5HashData":"1d5d767be226372deafbc19e716951e5","SHA256HashData":"ca3799b190ffd79c910dc0a4395b5b1fc6dacbfc2b8dbf65328d2a5ca09dec5a","ProcessSxsFlags":"64","AuthenticationId":"999","ConfigBuild":"1007.3.0011406.1","WindowFlags":"384","CommandLine":"\"E:\\Program Files\\Splunk\\bin\\SplunkD.EXE\" btool web list","ParentAuthenticationId":"999","TargetProcessId":"33794689225796","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\Splunk\\bin\\splunkd.exe","SourceThreadId":"439906675541924","Entitlements":"15","name":"ProcessRollup2V17","ProcessStartTime":"1597147019.397","ProcessParameterFlags":"24577","aid":"8abeeb6f90da4cf3abc45b5d6fdd79cf","cid":"0396954fdb9e4990ac33e9deb40e211b"}
... View more
08-07-2020
01:50 PM
Thanks for the info. I am making progress but not quite there yet. I think the problem is with the line breaking. The events are being being separated properly which is causing the regex to fail. I am guessing that I just need the proper line_breaker regex and I will be good. The end of line character in the json logs is } I thought I could just use that as my line breaker but it's not working properly. I have tried the line breaks below. LINE_BREAKER = } LINE_BREAKER = ([\r\n]+)
... View more
08-07-2020
11:08 AM
Here is a link the dataset and the regex. It is working on regexr but not in transforms.conf. I have tested by using . as my regex and it then sends all logs to the nullqueue so I know the stanzas are correct, it's a problem with the regex and I have not been able to figure it out. https://regexr.com/59qu2 Here are my stanzas from props.conf and transforms.conf props.conf [cs_replicator] TRANSFORMS-CS = EliminateCS2 Transforms.conf [EliminateCS2] REGEX = (?:{"ScreenshotsTakenCount".*|{"ProcessCreateFlags").* DEST_Key = queue FORMAT = nullQueue Any help is appreciated.
... View more
Labels
- Labels:
-
props.conf
-
transforms.conf
07-06-2020
05:57 PM
After a minor logic tweak, it works. Thank you so much! | where !(UserId="someuser" AND match(location_one,"United States") AND match(location_two,"United States"))
... View more
07-06-2020
11:05 AM
1 Karma
I am trying to tune an alert but need to only exclude if 2 of three fields do not contain a string. My goal is too tune out improbable access alerts where certain users log in from two locations within the united stats.
The search results are below
The SPL without the exclusion is below
`m365_default_index` sourcetype="o365:management:activity" Operation=UserLoggedIn
| rename ClientIP AS src_ip
| sort 0 UserId, _time
| streamstats window=1 current=f values(_time) as last_time values(src_ip) as last_src_ip by UserId
| iplocation last_src_ip
| rename Region as State
| eval last_location = if(isnotnull(City) AND City!="", City . ", ", "") . if(isnotnull(State) AND State!="", State . ", ", "") . if(isnotnull(Country) AND Country!="", Country . ", ", "")
| rename lat as last_lat lon as last_lon Country as last_Country
| iplocation src_ip
| rename Region as State
| eval location = if(isnotnull(City) AND City!="", City . ", ", "") . if(isnotnull(State) AND State!="", State . ", ", "") . if(isnotnull(Country) AND Country!="", Country . ", ", "")
| foreach *location
[ | eval <<FIELD>> = replace(replace(<<FIELD>>, "^\s*,\s*", ""), "\s*,\s*$$", "")]
| eval rlat1 = pi()*last_lat/180, rlat2=pi()*lat/180, rlat = pi()*(lat-last_lat)/180, rlon= pi()*(lon-last_lon)/180
| eval a = sin(rlat/2) * sin(rlat/2) + cos(rlat1) * cos(rlat2) * sin(rlon/2) * sin(rlon/2) | eval c = 2 * atan2(sqrt(a), sqrt(1-a))
| eval distance = 6371 * c, time_difference_hours = round((_time - last_time) / 3600,2), speed=round(distance/ ( time_difference_hours),2) | fields - rlat* a c
| eval day=strftime(_time, "%m/%d/%Y")
| search last_Country!=Country distance!=0 speed>1000
| stats values(time_difference_hours) as time_difference_hours values(speed) as speed first(last_location) as location_one first(location) as location_two values(*src_ip) as *src_ip min(_time) as firstTime by UserId distance day
| eval firstTime=strftime(firstTime, "%m/%d/%Y %H:%M:%S")
| sort - distance
| search NOT UserId="Unknown"
| search distance>500 AND speed>500
| lookup Executives.csv Email as UserId OUTPUTNEW Title
| lookup CriticalUsers.csv Email as UserId OUTPUTNEW Title
| eval Severity=case(isnotnull(Title),"Critical",isnull(Title),"Medium")
I have tried just about every combination of search NOT, search fielda!=blah, etc. Does anyone know how to do this? An example of what I have tried is below | search NOT UserId="someuser" AND NOT location_one="*United States" AND NOT location_two="*United States"
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-11-2020
11:20 AM
|
