About JChris_

JChris_ · ‎03-30-2023

Bump!?

JChris_ · ‎11-08-2022

Oh yes, I know the indexes will continue to be seen by everyone by default. The is a whole different issue which is way harder to deal with xD

richgalloway · ‎10-25-2022

SEDCMD will work with the right regex. Linefeeds are removed by the default line breaker so a regex is unlikely to find them. Try this, instead. [source::service] SEDCMD-redact=s/Description=".+"/Description="redacted"/

JChris_ · ‎08-18-2022

Thanks, that's exactly what I end up doing after I posted this thread xD

ITWhisperer · ‎04-21-2022

Try something like this | eval _raw=replace(_raw,"\\\\","") | eval _raw=replace(_raw,"\"{","{") | eval _raw=replace(_raw,"}\"","}") | spath

JChris_ · ‎04-08-2022

Thanks, I ended up using a slightly modified version of yours and it worked great: | eval StatusCode = if(Status == "ACTIVE", 1, 0) | eventstats max(StatusCode) as CumulativeStatus by Email | eval CumulativeStatus = if(CumulativeStatus == 1, "ACTIVE", "INACTIVE")

ITWhisperer · ‎08-27-2021

You could use the contents of the csv in a search to keep all the whitelisted and then repeat with NOT to get the unlisted ones | makeresults | eval _raw="cn;issuer srv1.example.com;C=US, O=Amazon, OU=Server CA 1A, CN=Amazon srv1.example.com;C=US, O=Amazon, OU=Server CA 1B, CN=Amazon srv1.example.com;C=US, O=Acme, OU=Acme CA, CN=Acme srv1.foobar.example.com;C=US, O=Let's Encrypt, CN=R3 srv2.foobar.example.com;C=US, O=Let's Encrypt, CN=R3 srv2.foobar.example.com;C=US, O=Amazon, OU=Server CA 1A, CN=Amazon foobar.example.com;C=US, O=Let's Encrypt, CN=R3" | multikv forceheader=1 | table cn issuer | search [| makeresults | eval _raw="cn;issuer srv1.example.com;C=US, O=Amazon, OU=*, CN=Amazon srv2.example.com;C=US, O=Amazon, OU=*, CN=Amazon *.foobar.example.com;C=US, O=Let's Encrypt, CN=*" | multikv forceheader=1 | table cn issuer | format] | eval whitelisted="yes" | append [| makeresults | eval _raw="cn;issuer srv1.example.com;C=US, O=Amazon, OU=Server CA 1A, CN=Amazon srv1.example.com;C=US, O=Amazon, OU=Server CA 1B, CN=Amazon srv1.example.com;C=US, O=Acme, OU=Acme CA, CN=Acme srv1.foobar.example.com;C=US, O=Let's Encrypt, CN=R3 srv2.foobar.example.com;C=US, O=Let's Encrypt, CN=R3 srv2.foobar.example.com;C=US, O=Amazon, OU=Server CA 1A, CN=Amazon foobar.example.com;C=US, O=Let's Encrypt, CN=R3" | multikv forceheader=1 | table cn issuer | search NOT [| makeresults | eval _raw="cn;issuer srv1.example.com;C=US, O=Amazon, OU=*, CN=Amazon srv2.example.com;C=US, O=Amazon, OU=*, CN=Amazon *.foobar.example.com;C=US, O=Let's Encrypt, CN=*" | multikv forceheader=1 | table cn issuer | format]]

JChris_ · ‎07-16-2021

Anyone?

ITWhisperer · ‎07-08-2021

Changing the source is the better approach. 😀

Posts	21
Solutions	1
Karma Given	3
Karma Received	0
Member Since	‎04-30-2021

Online Status	Offline
Date Last Visited	‎04-11-2023 06:56 AM

Can I disable Splunk DB Connect print_record_faile...

Are there any limitations to using Splunk Apps and...

How to redact the description field from the Servi...

Remove 1 field from syslog before sending to Splun...

How to parse string JSON along with actual JSON?

How to create cumulative field for duplicated resu...

How to match wildcard in a join left?

How to parse a JSON with a mutable node?

How to interpret the asterisk as a wildcard in a j...

Re: Can I disable Splunk DB Connect print_record_f...

Re: Are there any limitations to using Splunk Apps...

Re: WinHostMon Props and Transforms to redact fiel...

Re: Remove 1 field from syslog before sending to S...

Re: How to parse string JSON along with actual JSO...

Re: How to create cumulative field for duplicated ...

Re: How to match wildcard in a join left?

Re: How to interpret the asterisk as a wildcard in...

Re: How to parse a JSON with a mutable node?