About mag314

mag314 · ‎03-23-2023

How do you filter out IPv6 and internal routed 169.254.0.0/16 from a multi-value field? Data Example HOST IP LIST hostA 10.0.0.3, 10.3.4.6, 169.254.1.5, fe80::2000:aff:fea7:f7c hostB 10.0.0.2, 192.168.3.12, 169.254.8.9, fe80::2000:aff:fea7:d3c I have attempted using a number of combinations of mvfilter, match, cidrmatch and I can't get it to work. | eval ip_list_filter_IPv6 = mvfilter(match(ip_list_orig, "/\b(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))\b") | eval ip_list_filter_169 = mvfilter(match(ip_list_filter_IPv6, NOT cidrmatch(169.254.0.0/16,ip_list_filter_IPv6)) I thought cidrmatch might do it all but I believe it is not a validation macro but one that checks if an IP is in a given range. Thanks for your help.

mag314 · ‎02-24-2023

Is there any update as to when this option is available? I converted a number of DBs and now I am really stuck as the users all want the csv files. Argh!!

mag314 · ‎02-13-2023

Where do I set columns to wrap text? The old dashboards had a wrap results field.

mag314 · ‎02-09-2023

Is there a better location where I can get Splunk help?

mag314 · ‎01-30-2023

I have 3 panels across the top of my dashboard and one table panel underneath. How do I fix the top row (3 panels) from scrolling? How do I remove the larger vertical scroll bar? The image below shows how the table has a scroll bar but the overall dashboard also has a scroll bar. How do I remove this outer scroll bar?

mag314 · ‎03-09-2022

Is this still the case where you can not do lookups on multi value fields? e.g. I might have a list of 100 hosts similar to: hostname, (ip1, ip2) I want to add location, sys-owner to this table. Both IPs may have the same location but sys-owner will be differing. lookup table I want to see something like the following come out for each line. hostname ip1 Toronto Smith ip2 Toronto Jones How would I do this? | inputlookup mylastresults.csv | makemv delim=" " ip | mvexpand ip | lookup gatheripinfo ip OUTPUT location sys-owner | table hostname ip sys-owner

mag314 · ‎11-26-2020

This returns 0 results because the QID=48118 AND "WebLogic RCE - CVE-2020-14882" are in separate events. Is there a way to modify your original search to only show QID RESULTS that are 48118? I was trying to do it by filtering out the other QIDs at the beginning but then I lose the "WebLogic" events. Thank you.

mag314 · ‎11-26-2020

Interesting When I search index=qualys "WebLogic RCE - CVE-2020-14882" | return 1000 IP I get 3 IPs. When I add a dedup IP, index=qualys "WebLogic RCE - CVE-2020-14882" | dedup IP | return 1000 IP, I get 15 IPs. I double checked that I am running them over same 30d time span. Any ideas on why that would be the case? Assuming I use the dedup, this command works well. However since it is using an AND with the subsearch it only shows the 9 of 15 IPs that have the QID. How would I modify it so it would also show the remaining 6 IPs but with blank RESULTS? This is what I was trying to do with my second search in the original post. index=qualys QID=48118 [search index=qualys "WebLogic RCE - CVE-2020-14882" |dedup IP | return 1000 IP] | stats values(DNS) values(RESULTS) by IP Thank you so much for your assistance.

mag314 · ‎11-25-2020

Thanks for your response. Does the searchmatch search across all fields in the record? This returned the 15 systems however all RESULTS from systems with "WebLogic" are returned. How do I only show the RESULTS from QID=48118 and not other QIDs from systems that have "WebLogic". I want to search all systems with "WebLogic RCE - CVE-2020-14882" and for each of these systems list the QID=48118s if they exist.

mag314 · ‎11-25-2020

Thanks for the |format insight. That helps. When I use the return IP it only returns one IP not the list of IPs. What I would like to see is that there are 15 systems returned from the subsearch and then for each of those systems if they have any QID=48118s then they show up. If none exist then it is blank. i.e. The RESULTS could return a blank if none are found. Thank you.

mag314 · ‎11-24-2020

What is typically the best way to do splunk searches that following logic. First Search (get list of hosts) Get Results Second Search (For each result perform another search, such as find list of vulnerabilities My example is searching Qualys Vulnerability Data. Searching HTTP Headers first and including Tag results in search query index=qualys QID=48118 [search index=qualys "WebLogic RCE - CVE-2020-14882" | dedup IP | table IP] | stats latest(_time) values(DNS) values(RESULTS) by IP The issue with this search is that it doesn’t include systems with the RCE tag but no QID=48118 (HTTP Headers Data) Searching TAG first then Join index=qualys "WebLogic RCE - CVE-2020-14882" | dedup IP | table IP, DNS | join type=left IP [search index=qualys QID=48118 | dedup IP RESULTS] | stats values(DNS), values(RESULTS) by IP The issue here is that I only get back one HTTP RESULT, there should be a few for each port that is open. Any links to the best way to create subsearches from results would be great for learning. Thanks.

Posts	11
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎11-24-2020

Online Status	Offline
Date Last Visited	‎03-29-2023 12:29 PM

How to filter out IPv6 and 169.254.0.0/16 from a m...

How to wrap results in Dashboard Studio?

How to fix top panels from scrolling?

Subsearch - how to search based on results of firs...

How to filter out IPv6 and 169.254.0.0/16 from a m...

Re: Is there an option to export CSV or PDF in Spl...

How to wrap results in Dashboard Studio?

Re: How to fix top panels from scrolling?

How to fix top panels from scrolling?

Re: Lookup on all values of a multivalue field

Re: Subsearch - how to search based on results of ...

Re: Subsearch - how to search based on results of ...

Re: Subsearch - how to search based on results of ...

Re: Subsearch - how to search based on results of ...

Subsearch - how to search based on results of firs...