Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About silverem78
silverem78
Engager
Member since:
09-22-2020
10-13-2021
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 09-22-2020 |
Activity Feed
- Posted AD user account will be expired in the next 7 days on Security. 10-13-2021 06:27 AM
- Posted Re: how to store a value from rex and reuse this value in another search on Splunk Search. 05-27-2021 02:04 AM
- Posted Re: how to store a value from rex and reuse this value in another search on Splunk Search. 05-27-2021 12:55 AM
- Posted how to store a value from rex and reuse this value in another search on Splunk Search. 05-27-2021 12:27 AM
- Posted Re: Filter sender email which not contains specific subdomain and domain on Splunk Search. 09-24-2020 02:43 AM
- Posted Filter sender email which not contains specific subdomain and domain on Splunk Search. 09-23-2020 06:46 AM
- Posted Re: splunk concatenate field in table on Splunk Search. 09-22-2020 06:48 AM
- Posted Re: splunk concatenate field in table on Splunk Search. 09-22-2020 04:44 AM
- Posted Re: splunk concatenate field in table on Splunk Search. 09-22-2020 03:44 AM
- Posted Re: splunk concatenate field in table on Splunk Search. 09-22-2020 03:39 AM
- Posted Re: splunk concatenate field in table on Splunk Search. 09-22-2020 03:20 AM
- Posted Re: splunk concatenate field in table on Splunk Search. 09-22-2020 03:07 AM
- Posted splunk concatenate field in table on Splunk Search. 09-22-2020 02:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-13-2021
06:27 AM
Hi Fellows, i try to have some statistics about AD user which their AD account will be expired in 7 days. I need help because my request doesn't work as expected; I got the list of all user account. Do i need ldsearch instead of EventCode=4738 to get all users? the list displyed in only 1 month after, something like the relativetie function doesnt work correctly. index=* EventCode=4738 Account_Expires!="-" | eval is_interesting=strptime(Account_Expires,"%m/%d/%Y") | where is_interesting < relative_time(now(),"+7d@d") | table user status Account_Expires is_interesting
... View more
05-27-2021
02:04 AM
Hi I got an error.
... View more
05-27-2021
12:55 AM
I got an error with: search index=* sourcetype=log2 src_ip="1.1.1.1"
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip | fieldformat I got nothing (with no error) : index=* sourcetype=log1 [search index=* sourcetype=log2 src_ip="1.1.1.1"
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | fields src_ip ] it is like "[search index=* sourcetype=log2 src_ip="1.1.1.1" | rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | fields src_ip ] " doesnt provide value. 2.2.2.2 ...
... View more
05-27-2021
12:27 AM
Dear fellows, I have two logs and i am looking to do some correlation between them. In the log1, i am looking for IP_x (ex: 2.2.2.2)associated with IP_1 (1.1.1.1), then reuse the value of IP_x (2.2.2.2) in another search. When i execute, i got nothing. index=* sourcetype=log1 [search index=* sourcetype=log2 src_ip="1.1.1.1" | rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip ] src_ip if i do this, i got the details index=* sourcetype=log1 2.2.2.2 when i execute manually the search , i got the table with 2.2.2.2 search index=* sourcetype=log2 src_ip="1.1.1.1" | rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip Any helps will be welcomed
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
09-24-2020
02:43 AM
Thank you . Works like a charm
... View more
09-23-2020
06:46 AM
Dear all, I try to filter sender email which not contains specific 3 subdomains and domain. For example: sender: [email protected] [email protected] [email protected] [email protected] [email protected] i want just display with stats sender [email protected] user [email protected] I try to add index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid [...} where mvcount(recipient) > 5 and sender !="[\w][\w\-\.]+@(?domain.com)" or using this: | rex field=sender "[\w][\w\-\.]+@(?<domain>\w[\w\-\.]+[a-zA-Z]{2,5})" | stats sum(count) as count by domain_detected | eval domain_detected=mvfilter(domain_detected!="*.domain.com") without success
... View more
09-22-2020
06:48 AM
I found what i want : index = * sourcetype="cisco:esa:textmail" | eventstats values(src) AS cs_ip BY icid | eventstats values(dest) AS ss_ip BY dcid | eval recipient_count=mvcount(recipient) | stats values(internal_message_id) AS tmpMID values(icid) AS icid values(sender) AS sender values(recipient) AS recipient values(message_size) AS message_size values(antivirus_status) as antivirus_status values(quarantine_dest) as quarantine_dest values(reason) as reason values(virus_vendor_category) as virus_vendor_category values(response) AS response values(message_subject) as message_subject values(cs_ip) AS cs_ip values(ss_ip) AS ss_ip values(dcid) AS dcid BY internal_message_id | eval recipient_count=mvcount(recipient) | eval mid=tmpMID | mvexpand mid | eventstats values(tmpMID) AS tmp BY mid | eval t=mvjoin(tmp, " ") | stats values(sender) AS sender values(recipient) AS recipient values(message_subject) as subject values(antivirus_status) as antivirus_status values(quarantine_dest) as quarantine_dest values(reason) as reason values(virus_vendor_category) as virus_vendor_category max(message_size) AS message_size max(recipient_count) AS recipient_count values(internal_message_id) AS internal_message_id values(dcid) AS dcid values(response) AS response values(cs_ip) AS cs_ip values(ss_ip) AS ss_ip BY icid
... View more
09-22-2020
04:44 AM
I want to check MID with the value : 14:44:56 mail_logs: Info: MID 3037591 SPF: mailfrom |rex "\s+MID\s+\<\|?(?<MID>[^\>]+)" ?
... View more
09-22-2020
03:44 AM
MID is not a field but is displayed in the line. So i think i need to use regex expression. For each specific MID displayed in each line, diplays in a table , MID id and associated stats values
... View more
09-22-2020
03:39 AM
Ok thank you. Example: in one line get the following extract from multiple line in the search: for each specific MID, display the associated field sender,message_subject,recipient,reason,virus_vendor_category ,MID, sender,message_subject,recipient,reason,virus_vendor_category 3035876,[email protected],[email protected],Revised Order 21-09-20, "Virus" (a/v verdict:VIRAL), CXmail/RtfObf-D 3035879,[email protected],[email protected],Invoice 21-09-20, "Virus" (a/v verdict:VIRAL), CXmail/RtfObf-B 3035880,[email protected],[email protected],Invoice2 21-09-20, "Virus" (a/v verdict:VIRAL), CXmail/RtfObf-D
... View more
09-22-2020
03:20 AM
Example: in one line get the following extract from multiple line in the search: for each specific MID, display the associated field sender,message_subject,recipient,reason,virus_vendor_category ,MID, sender,message_subject,recipient,reason,virus_vendor_category 3035876,[email protected],[email protected],Revised Order 21-09-20, "Virus" (a/v verdict:VIRAL), CXmail/RtfObf-D [email protected] is in a line, each field are in different lines
... View more
09-22-2020
03:07 AM
I want in fact a table which give me per line for every threat per user the follwing details example: sender,message_subject,recipient,reason,virus_vendor_category [email protected],[email protected],Revised Order 21-09-20, "Virus" (a/v verdict:VIRAL), CXmail/RtfObf-D
... View more
09-22-2020
02:52 AM
Hi, As newcomer to splunk , i have the following ironport log : <38>Sep 22 02:15:35 mail_logs: Info: Message finished MID 3035876 done <38>Sep 22 02:15:35 mail_logs: Info: MID 3035876 quarantined to "Virus" (a/v verdict:VIRAL) <38>Sep 22 02:15:34 mail_logs: Info: MID 3035877 was generated based on MID 3035876 by antivirus <38>Sep 22 02:15:32 mail_logs: Info: MID 3035876 attachment 'Revised=20Order.doc' <38>Sep 22 02:15:32 mail_logs: Info: MID 3035876 antivirus positive 'CXmail/RtfObf-D' <38>Sep 22 02:15:32 mail_logs: Info: MID 3035876 interim AV verdict using Sophos VIRAL <38>Sep 22 02:15:32 mail_logs: Info: MID 3035876 was too big (1456210/1048576) for scanning by CASE <38>Sep 22 02:15:32 mail_logs: Info: MID 3035876 matched all recipients for per-recipient policy DEFAULT in the inbound table <38>Sep 22 02:15:31 mail_logs: Info: MID 3035876 ready 1456210 bytes from <[email protected]> <38>Sep 22 02:15:31 mail_logs: Info: MID 3035876 Subject 'Revised Order 21-09-20' <38>Sep 22 02:15:31 mail_logs: Info: MID 3035876 Message-ID '<[email protected]>' <38>Sep 22 02:15:31 mail_logs: Info: MID 3035876 DMARC: Verification passed <38>Sep 22 02:15:31 mail_logs: Info: MID 3035876 DMARC: Message from domain swiftsecuritas.in, DMARC pass (SPF aligned True, DKIM aligned True) <38>Sep 22 02:15:31 mail_logs: Info: MID 3035876 DKIM: pass signature verified (d=swiftsecuritas.in s=73FEA6D0-E5D5-11EA-A7BE-617208D79BCE [email protected]) <38>Sep 22 02:15:13 mail_logs: Info: MID 3035876 SPF: mailfrom identity [email protected] Pass (v=spf1) <38>Sep 22 02:15:11 mail_logs: Info: MID 3035876 SPF: helo identity [email protected] None <38>Sep 22 02:15:11 mail_logs: Info: MID 3035876 ICID 1856276 RID 0 To: <[email protected]> <38>Sep 22 02:15:11 mail_logs: Info: MID 3035876 ICID 1856276 From: <[email protected]> <38>Sep 22 02:15:11 mail_logs: Info: Start MID 3035876 ICID 1856276 I have extract the field and i want to create a table to get statistic: table sender,message_subject,recipient,quarantine_dest,reason,virus_vendor_category When i try it, i got a table per one line. How to concatenate all line to get all statistics, please Rgds silverem
... View more
Labels
- Labels:
-
field extraction
-
stats
-
table
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-13-2021
10:58 AM
|
