Afternoon All, Have been playing with a search that will eventually become a saved search within Splunk ES. Idea is for the search to run and pull in observables that are populated in the ip_intel lookup file and then populate an index. So far I have this which works fine: | inputlookup ip_intel append=true | dedup ip | collect index=backup_ti source=daily_ip_intel The problem is, the inputlookup automatically displays all rows within the file. Im looking to have this search run once a day only updating the index with new observables rather than duplicating or overwriting the existing data. Is there a way to do this? The timestamp against the indicators within that file are messy so its not possible to exclude them via a relative time sub search for example. ... View more

Morning Community, Looking at a way to pull multiple columns into an alert Im attempting to build. In the below syntax this gives me hits on the a src IP that appears in the lookupfile which is great however I also want to pull in extra columns associated with the hit on that IP. The lookup file contains columns labelled "tag" "info" and "comment" which would further enhance the usefulness of this alert. index=netscaler sourcetype="citrix:netscaler:syslog" citrix_netscaler_event_name=LOGIN action=success app=SSLVPN | search [| inputlookup my.csv | rename value as src | fields src ] I've tried this and returns no results. index=netscaler sourcetype="citrix:netscaler:syslog" citrix_netscaler_event_name=LOGIN action=success app=SSLVPN | search [| inputlookup my.csv | rename value as src | fields src ] | lookup my.csv info as src.info output info as src.info Any thoughts at all? This article was a little similar to what Im trying to do, except I need the extra columns data from the src IP hits from the 1st part of the alert.  https://community.splunk.com/t5/Splunk-Search/Pulling-multiple-Columns-from-an-inputlookup/m-p/424742 ... View more

Morning Team, Currently looking at trying to convert what i think is 10 digit Unix/Epoc time into a human readable format but struggling to find the right syntax. "timestamp" field values: 1561012289 1561012304 1561012315 1609193962   Any assistance would be appreciated, happy to provide more info if needed! ... View more

Afternoon Team, Was hoping to get some assistance with building an alert in Splunk Enterprise Security that can pick up on old aws keys that were created in the past at a certain point - potentially 6 months for example. The below is a preliminary alert that im building but could use some guidance.  We are ingesting events from AWS cloudtrail. index="aws-cloud-trail" responseElements.accessKey.accessKeyId=AKIA* | spath eventName | search eventName=CreateAccessKey userIdentity.type!=AssumedRole | rename responseElements.accessKey.createDate as creationdate | eval creationdate=strptime(creationdate, "%H:%M.%S %p, %a %m/%d/%Y") | where creationdate < (now() - (86400 * 30)) | table sourceIPAddress userName src_user userIdentity.type userAgent action status creationdate responseElements.accessKey.status responseElements.accessKey.accessKeyId Has anyone else come across something similar?    Be great to hear from you! Happy to lend more context if needed. ... View more