Hello, I'm trying to extract some SSID info into a field in Splunk. This info comes after a certain text string in some Cisco WLC logs. Sample logs: Jul 18 15:00:27 10.171.12.44 DA-WLC-03: *Dot1x_NW_MsgTask_0: Jul 18 15:00:25.919: %APF-3-AUTHENTICATION_TRAP: [SA]apf_80211.c:20019 Client Authenticated: MACAddress:fa:f0:6c:56:34:bf Base Radio MAC:a0:93:51:22:38:b0 Slot:0 User Name:dave2345@ox.ac.uk Ip Address:10.156.4.11 SSID:eduwifi Jul 18 15:20:3510.171.12.44 DA-WLC-03: *Dot1x_NW_MsgTask_0: Jul 18 15:20:33.510: %APF-3-AUTHENTICATION_TRAP: [SA]apf_80211.c:20019 Client Authenticated: MACAddress:b8:27:56:34:cc:d0 Base Radio MAC:a0:93:51:22:38:b0 Slot:0 User Name: unknown Ip Address:10.156.4.11 SSID:W-Guest These logs are often different lengths but the common feature I want to initially capture as a field is what comes after the text SSID: I can use this basic regex string in testing on regex101.com and it seems to do the trick: (?:<=SSID:).* but whenever I try toeither extract the field or use the rex command in splunk it does not work. Please could someone tell me if this is the correct regex expression and what formatting would i need to use in splunk to extract the field ?     wifiThis seems to be a common request but I can't get it to work  ... View more

I'm looking to get a connections per minute search which breaks the results down by the hour. For example something like the following: 0900-1000  16.68 1000-1100   6.58 1100-1200  4.75 1200-1300  3.87 I have a search that works out the connections per minute average for a period of time: index=cisco* product=ASA "AAA retrieved default group policy*"  | timechart span=1m count | stats avg(count) as avg_count | eval avg_count=round(avg_count,2) Is there an easy way to adapt this so that i can search across today for example and have it return the many different values at different hours?     ... View more

I'm looking to do a search that captures a snapshot of how many devices from certain subnets we have had going through our firewall in the last 20 minutes but for each preceding hour in the day. The basic search for this is pretty straightforward:     index="firewall_std" src="10.19*.*.*" | dedup src  with the time selected as last 20 mins But for example if I run this search at 2pm with the time selected for today I want if possible to bring back what the count total was for the last 20 mins at 1pm, 12pm, 11am, 10am, 9am... etc. I've achieved it by appending another search for each hour and -20m (see below) but was wondering if there was a easier more streamlined way to do this?  | append [search index="firewall_std" src="10.19*.*.*"  earliest=-1h@m-20m latest=-1h@m | dedup src | stats min(_time) as _time count as Count | eval hour="02" | fields hour, _time, Count ]       ... View more

Hello, I'm pretty new to SPLUNK and I'm looking for help trying to find ASA open connections between two endpoints. Most connections I search for have a 'Built' action and then some time after a corresponding 'teardown' action. I'm looking for those connections that have the 'Built' action  but not the 'teardown' action. The basic search I have pulls down all of the connections between the two:.  index="cisco" src_ip="10.55.45.12" dest_ip="10.65.45.20" dest_port=445 Is there a way to expand this search to find  these open connections based on the absence of a teardown?   Is there a way to  ... View more