About spicy

spicy · ‎09-01-2021

Ok I fount the answer... \Qextract$anythin\gbetween\E|\Qsomethingelse\E start with a \Q end with \E and if your extracting a string that contains \E OR \Q you can rex mode=sed replace it to be \e \q prior to extraction, with case sensitivity turned off.

spicy · ‎09-01-2021

The _raw field will be a lot more randomness. The list of strings I am searching is quite complex as well, would not be able to add \ to every string for extraction.

spicy · ‎09-01-2021

The _raw is mostly network logs. netflow, all zeek types, 0365, web, and some EDR solutions with enrichment so its kind of all over the place. all formats too, json, csv, tab delimited.

spicy · ‎08-31-2021

I have a list of hundreds of string values that need to be extracted from a field the problem is the values that need to be extracted contain special characters i.e. (\, $, \\, ^, . . .) Is there an easy way im missing to extract the literal characters? what I have tried (example list) | makeresults | eval raw_field_example = "$money$ "?question?" "help$.." "random" "text" | makemv raw_field_example delim=" " | rex field=raw_field_example "(?<literal_items_I_want>"money"|$money$|"text"|"help$..")" results for literal_items_I_want are only: money text tried putting the @ symbol before each double quotes but didnt work... thanks for the help

spicy · ‎07-29-2021

| rex max_match=0 field=_raw "(?<extractedfieldname>(17|7|1))" this will work but will still need the variable to be passed to this rex

spicy · ‎07-29-2021

with the replace is it only gonna show me one hit from the passed list or does it need to be appended in some way?

spicy · ‎07-29-2021

I am extracting a list of free text string in the _ raw and creating a new field. The list of terms comes from user input, on the search input of a dashboard. I cant seem to find how to place the token/variable in the regex... probably something easy im missing. $token$="test|google|domain|badguy" (formmated this way so regex can see it as OR separated list) rex field=_raw " (?<extractedfieldname>$token$) (does not work) Is there a way to do this? if not a token option, can i: eval tokenname=$token$ rex field=_raw " (?<extractedfieldname>'tokenname') (does not work) After the token/variable is placed correctly this is the search format im looking for: rex field=_raw " (?<extractedfieldname>test|google|domain|badguy) (this does work) thanks for any help!

spicy · ‎05-11-2021

Thanks! Gonna have to apply this knowledge to other queries now

spicy · ‎05-11-2021

The case function seems to finding the first true statement and displays that value. Is there another function or different way to use case to get the results i want below? There are different events with similar features below, want something that would use for all different scenarios of when something is true or false. Event Fields i am filtering on: vpn=true proxy=false tor=true What im using: | eval anon= case(vpn="true", "vpn" , proxy="true", "proxy", tor="true", "tor") results im getting: anon=vpn results i want: anon=vpn tor thanks for any help!

spicy · ‎05-05-2021

Appreciate the help! I worked on join too, but still no luck. The biggest problem I think is using the tabled uid field from query1 then using it as a lookup in query2 (without creating a lookup). if you have any suggested spl for me to try that would be great. overview of the goal: Sourctype DNS fields Sourcetype Conn uid, query uid, src_ip, dest_ip if (dnsuid = connuid) then table uid, src_ip, dest_ip, query

spicy · ‎05-04-2021

Hi I am running into a problem when it come to subsearches. I want to use results from the first search to plug into the second search. The uid/keyvalue ties multiple sourcetypes together, with each sourcetype comes similar and unique information. It would be great to correlate this info by a table or stats. FYI Both sourctypes have an uid field dns sourcetype has the contains query field conn sourcetype has the other fields wanting display index="main" sourcetype=conn uid=keyvalue [ search index="main" sourcetype=dns | rename uid as keyvalue | table keyvalue] | fields proto, query, id.orig_h | table uid, query, proto, id.orig_h

spicy · ‎02-11-2021

@bowesmana Thanks! this will work for my needs, I only have one column of blacklist ips.

spicy · ‎02-10-2021

I am trying to run two fields against one column using a lookup. This SPL does not work, but conveys what I am trying to do. | lookup blacklist.csv ioc_list AS (src_ip OR dest_ip) OUTPUTNEW ioc_list, feedback Is there a way I can do something like the above command without running two separate lookup commands?

Posts	13
Solutions	1
Karma Given	3
Karma Received	0
Member Since	‎02-10-2021

Online Status	Offline
Date Last Visited	‎10-06-2021 03:26 PM

rex extract literal stings with special character...

Pass a token to regex or pass a field to regex

how to get the case function to have multiple stat...

filter on results of subsearch for the second sear...

way to run mulitple fields against a lookup, with ...

Re: rex extract literal stings with special chara...

Re: rex extract literal stings with special chara...

Re: rex extract literal stings with special chara...

rex extract literal stings with special character...

Re: Pass a token to regex or pass a field to regex

Re: Pass a token to regex or pass a field to regex

Pass a token to regex or pass a field to regex

Re: how to get the case function to have multiple ...

how to get the case function to have multiple stat...

Re: filter on results of subsearch for the second ...

filter on results of subsearch for the second sear...

Re: way to run mulitple fields against a lookup, w...

way to run mulitple fields against a lookup, with ...