About daniel_althoff8

daniel_althoff8 · ‎03-30-2023

Im trying to create multiple fields names from the same based on condition that other values are met. I need to do this multiple times in 1 search to create new field names For example; if event=av AND cmd=judgement then RENAME the field "result" to AV_Result if event=spam AND cmd=judgement then RENAME the field "result" to Spam_Result if action=quarantine AND mod=session AND cmd=kill then RENAME the field "Folder" to "Final_Folder_Result" Id like to do all this in 1 search

daniel_althoff8 · ‎03-05-2023

How would I find license usage by field? For example; I want to know which field values within a specific sourcetype account for the greatest volume of events and license usage. Thanks in advance!

daniel_althoff8 · ‎07-29-2021

I have set up some Numerical Outlier detections in the MLTK, on our ES Search Head. They are set up as alerts in Splunk on our Enterprise Security Search Head. The Numerical Outlier alert looks back over a 2 hour time range. Which creates 24 data points (120 mins / 5 min increments = 24 event data points) The problem is - in Enterprise Security (since this is a notable event), we receive 24 separate notable events! We correctly only receive 1 email each time the alert fires, but 24 notable events in ES. I have the alert set to trigger "Once", rather than "Per Result" Is there anything else I can do to make sure ES doesn't get slammed with 24 notables every time this alert fires?

daniel_althoff8 · ‎08-18-2020

Is anyone aware of a dashboard visualization that will allow me to edit a lookup table in the UI? Rather than using Lookup Editor? I want to visualize a table, but then dynamically change the value of a column in the UI. Thoughts?

daniel_althoff8 · ‎08-10-2020

Unfortunately, I am still getting the same issue. Where every time the search is ran, now the eval stanza forces the weight back to 0. I need to be able to edit the lookup table, but when the search runs, my edits wont change. The goal is to run a saved search to automatically add any new host (and not duplicate the host list) to the lookup table list with a default weight value, and then modify the weight values manually, but not have them revert back to the default weight value.

daniel_althoff8 · ‎08-07-2020

The above suggestion still wipes out the "weight1" values from the lookup editor every time that search is ran. The goal is this--- Create a search that creates a lookup table of all hosts in the environment, and assign a value to each host. The search will run on a schedule so that any time a new host is created, the lookup table gets populated with that new host/ asset. I want to assign a # value (that can be edited) to each host in the lookup table, that can be used and queried against for other metrics later on. So the search needs to populate just the "asset" column, but not modify the "weight" column everytime the search is ran.

daniel_althoff8 · ‎08-07-2020

I am trying to write a search that will update a lookup asset table, with an additional table column metric (weight1). However, I want to be able to append the asset column, without the 2nd column being appended. Is this possible? example: index=* host=* | table host weight1| dedup host | rename host AS asset| outputlookup append=false asset_score.csv This will run as a saved search to update the lookup table periodically. However, if I modify the "weight1" column values in lookupeditor, the changes get wiped out whenever the above saved search runs. Any suggestions?

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎08-07-2020

Online Status	Offline
Date Last Visited	‎03-30-2023 05:20 PM

How to rename fields conditionally?

How would I find License usage by Field?

Machine Learning Outliers in Enterprise Security

Is there a dashboard visualization that allows edi...

outputlookup append one field but not another