Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About moayadalghamdi
moayadalghamdi
Path Finder
Member since:
01-04-2021
12-11-2022
Community Statistics
| Posts | 37 |
| Solutions | 1 |
| Karma Given | 18 |
| Karma Received | 0 |
| Member Since | 01-04-2021 |
Activity Feed
- Karma Re: Extract Domain and Top Level Domain for ITWhisperer. 12-11-2022 01:23 AM
- Posted How to extract domain and top level domain? on Splunk Search. 12-11-2022 12:37 AM
- Posted Re: extract text using regex on Splunk Search. 01-12-2022 05:22 AM
- Karma Re: extract text using regex for isoutamo. 01-12-2022 05:21 AM
- Posted Re: extract text using regex on Splunk Search. 01-12-2022 05:20 AM
- Karma Re: extract text using regex for gcusello. 01-12-2022 05:19 AM
- Posted extract text using regex on Splunk Search. 01-12-2022 03:55 AM
- Posted Re: Extracting values from a field on Splunk Enterprise Security. 08-02-2021 02:17 AM
- Karma Re: Extracting values from a field for ITWhisperer. 08-02-2021 02:16 AM
- Posted Extracting values from a field on Splunk Enterprise Security. 08-02-2021 01:12 AM
- Tagged Extracting values from a field on Splunk Enterprise Security. 08-02-2021 01:12 AM
- Posted Change Data Presentation in Single Value Visualization on Splunk Enterprise Security. 08-01-2021 02:39 AM
- Posted Re: Only Failed Users without Any other Successful attempts on Security. 07-12-2021 12:12 AM
- Karma Re: Only Failed Users without Any other Successful attempts for ITWhisperer. 07-12-2021 12:12 AM
- Karma Re: Only Failed Users without Any other Successful attempts for ITWhisperer. 07-12-2021 12:12 AM
- Karma Re: Only Failed Users without Any other Successful attempts for ITWhisperer. 07-12-2021 12:12 AM
- Karma Re: Only Failed Users without Any other Successful attempts for ITWhisperer. 07-12-2021 12:12 AM
- Posted Re: Only Failed Users without Any other Successful attempts on Security. 07-12-2021 12:02 AM
- Posted Re: Only Failed Users without Any other Successful attempts on Security. 07-11-2021 11:52 PM
- Posted Re: Only Failed Users without Any other Successful attempts on Security. 07-11-2021 11:43 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-11-2022
12:37 AM
Dears
I need your help in extracting the domain and top level domain from dns queries where:
Query Field | extracted field
Account.fb.com . Fb.com
Aa.bb.cc.com . Cc.com
Www.google.com . Google.com
Thanks in advance
... View more
Labels
- Labels:
-
Other
01-12-2022
03:55 AM
hi, i want to extracted the first word from each variable the index has a field called search_name which has these variables: Risk - 24 Hour Risk Threshold Exceeded - Rule Endpoint - machine with possible malware - fffff Network - Possible SQL injection - Rule i want to perform a regex to extracted the first word out of each variable so the output would be: risk endpoint network thanks ^_^
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
08-02-2021
02:17 AM
sir you're a legend, thanks ^_^
... View more
08-02-2021
01:12 AM
Hello Splunker usernames in my environment are shown as : user=Company\username@AD# where the # is a number and some users are shown as: user=Company\username$@AD# the username has many variations" only numbers only letters combination of both i want to extract only the username with the other letters thanks ^_^
... View more
- Tags:
- regex
Labels
- Labels:
-
correlation search
08-01-2021
02:39 AM
Hello Splunkers. i made a splunk search to count the number of blocked URLs as a single value in a one day span of 3days period of search. here's my search: index=proxy action=blocked | bin _time span=1d | stats count(http_url) by _time and here's the results: i want to show it in thousands of tried, i tried this this search but the results doesnt appear: index=proxy action=blocked | bin _time span=1d | eval url_count= http_url/1000 | stats count(url_count) by _time but there are no results please help me with it, thanks ^_^
... View more
Labels
- Labels:
-
Other
07-12-2021
12:12 AM
it worked! thanks man, you're the best !
... View more
07-12-2021
12:02 AM
sorry for that, i took the wrong screen shot. here's the actual screenshot with the bin command. im so sorry to bother you.
... View more
07-11-2021
11:52 PM
sorry but its not working. here's the search. and here's the search with the count by _time
... View more
07-11-2021
11:43 PM
sorry but i need it in timechart, so i can see the changes overtime. i used | timechart count and | timechart span=1d count but no statistics neither visuals was shown. pleas help with it, thanks ^_^
... View more
07-11-2021
11:10 PM
Hello. i had 27 results of distinct users who never had a successful login, i want those 27 results as a single count value i want to show it like this this is a 3d search with span=1d, i want something similar. thanks ^_^
... View more
07-11-2021
04:16 AM
another help Mr. Whisperer i want to show this value as a single count to show it in a "single value" visualization. Thanks again ^_^
... View more
07-11-2021
04:02 AM
you really deserve the rank LEGEND Thanks a lot ^_^
... View more
07-11-2021
03:38 AM
Hello Splunkers i want to print events for only the users who has failed login attempts but never allowed attempts. here's my search index=MyApp eventype=authentication action=fail user=* but this one prints all failures even if they have other successful attempt. i only want users with only failed attempts without other successful attempts, i hope the picture below clears things: green: user only have successful logins Yellow: user have both successful/failed logins Red: user only have failed logins i want the red area only Thanks
... View more
Labels
- Labels:
-
access control
-
authentication
06-20-2021
01:55 AM
wait, the problem if from my side, my log sources have missing data. sorry for that, BTW you helped my a lot in many posts, thanks whisperer ^_^
... View more
06-20-2021
01:31 AM
Sorry, i just noticed that my post was confusing what i want is to show the the trends of these three fields in a "line chart" visualization i want the trend by any value of my choosing for example i want like this, but with multiple fields based on the search
... View more
06-20-2021
01:05 AM
Thanks for the prompt response ^_^ but i need it in time chart for visualization, help me with it plz Thanks ^_ ^
... View more
06-20-2021
12:55 AM
Hello Splunkers in my firewall logs, i have three numerical fields, (out_packet, in_packet, bytes) i want to sum these values each field individually but a i want the answer in one record for example: index=firewall | timechart sum (bytes) as bytes , sum (in_packet) as in_packet, sum (out_packet) as out_packet unfortunately it didn't work, please help me with it Thanks ^_^
... View more
- Tags:
- sum
05-27-2021
02:57 AM
w'ere getting close ! unfortunately the src_ip field is null: also the are empty records/Almost empty records: thanks so much for your time, i really appreciate it, please help with this one ^_^
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-11-2022
04:54 AM
|
Karma given to
