Hello,   I am trying to create a splunk alert to trigger when it detects an anomaly in the firewall logs based on IDS signature.   I created a pretty good graph that would work well in a dasboard, but I need it to populate a table or stats on when a outlier is found and which signature it is.   This is what I have so far: index="firewall" sourcetype="threat" tag=attack action=allowed | bin _time span=4h | eventstats count(signature) as "Count" by _time | eventstats values(Count) as valu | eventstats count(valu) as help by _time | eventstats median(Count) as med | eval newValue = abs(Count-med) | eventstats median(newValue) as medianAbsDev by signature | eval upper = med+(medianAbsDev*1.1) | eval lower = 0 | eval isOutlier=if(Count < lower OR Count > upper, 1,0) | timechart count span=1h count(signature) as CountOfIndicator, eval(values(upper)) as upperl, eval(values(lower)) as lowerl, eval(values(isOutlier)) as Outliers by signature usenull=f useother=f |filldown     I just need to be able to identify the outliers in a table so I can have it generate an alert when the query has results. ... View more

Hello,   I am trying to use a lookup table to search against the URL field inside of the proxy logs. The use case is to find out if any users have been accessing any domains/URL's that is listed in the lookup file. I am trying to strip away all the extra characters and keep the url/domain that it is matching on. This is what I have so far:   index=proxy sourcetype=proxy:syslog:proxy_web_policy[|inputlookup lookupfile_last_status  |return 1000 $lookup_domain_name]|rex field=proxy_url_field "(?<lookup_domain_name>(\w+\.)+\w+)"|table name url status Example: www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=gist.github.com/mcaj-admin/18558a1ec6a782d2452f971e806230c6&oit=3&url=https://gist.github.com/mcaj-admin/18558a1ec6a782d2452f971e806230c6&pgcl=4&gs_rn=42&psi=VqC6Zso_KQ3pgOGL&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw   is is matching on "gist.github.com/mcaj-admin/18558a1ec6a782d2452f971e806230c6" How can I strip away everything but what it is matching on? I am trying to figure out how to use regex + the lookup   Thanks.   ... View more

I am trying to run a query where it compares a search result field against a field in the lookup table. I was able to get it working, but then I am trying to also show the corresponding field with that object that is located in the lookup table.   This is what I have so far index=zscaler sourcetype="zscaler:syslog:zscaler_web_policy" [| inputlookup "riskiq_last_status" | return 1000 $name] |table url status It is just matching the name field in the lookup table to the url field in the index search query. I am guessing the status field is blank because there isnt a status field in the index search results.... How do I add a a field in the lookup table to the search query results? ... View more