About wilcomply13

wilcomply13 · ‎01-24-2022

I have the following JSON: { "kind": "report", "id": { "time": "2021-12-24T15:45:01.331Z", }, "events": [ { "parameters": [ { "name": "field1", "boolValue": true }, { "name": "field2", "boolValue": true }, { "name": "field3", "value": "value3" }, { "name": "field4", "value": "value4" }, { "name": "field5", "boolValue": false }, { "name": "field6", "value": "value6" }, { "name": "field7", "value": "value7" }, { "name": "field8", "boolValue": false }, { "name": "field9", "value": "value9" }, { "name": "field10", "boolValue": false }, { "name": "field11", "boolValue": false } ] } ] } I'd like to marry the key/value pairing of name/value and name/boolValue with their corresponding values i.e. field1: true field4: value4 I've attempted to use spath to extract values, but keep coming up short.

wilcomply13 · ‎01-10-2022

Jan 10 15:08:21 host.domain.com 2022-01-10 15:07:38 reason=Allowed event_id=000000000000 protocol=HTTPS action=Allowed transactionsize=1111 responsesize=111 requestsize=1111 urlcategory=Custom URL Category serverip=8.8.8.8 clienttranstime=111 requestmethod=POST refererURL=www.google.com/ ClientIP=9.9.9.9 status=204 user=user@domain.com url=www.google.com/gen_204?atyp=csi&ei=rUvcYZ-iM5GV0PEPt9uH8As&s=web&st=13120&fid=2&t=fi&zx=1641827258879

wilcomply13 · ‎01-10-2022

This is a search time field extraction: props.conf [proxy-web] FIELDALIAS-ClientIP_as_src=ClientIP AS src FIELDALIAS-ClientIP_as_src_ip = ClientIP AS src_ip FIELDALIAS-aob_gen_proxy_web_alias_1 = protocol AS transport FIELDALIAS-aob_gen_proxy_web_alias_2 = user AS src_user FIELDALIAS-aob_gen_proxy_web_alias_3 = dlpengine AS severity FIELDALIAS-aob_gen_proxy_web_alias_4 = threatname AS signature FIELDALIAS-aob_gen_proxy_web_alias_5 = contenttype AS http_content_type FIELDALIAS-aob_gen_proxy_web_alias_6 = hostname AS dest FIELDALIAS-aob_gen_proxy_web_alias_8 = responsesize AS bytes_in FIELDALIAS-aob_gen_proxy_web_alias_9 = requestsize AS bytes_out FIELDALIAS-clientpublicIP_as_src_translated_ip = clientpublicIP AS src_translated_ip FIELDALIAS-clienttranstime_as_response_time = clienttranstime AS response_time FIELDALIAS-department_as_src_user_bunit = department AS src_user_bunit FIELDALIAS-dlpdictionaries_as_signature = dlpdictionaries AS signature FIELDALIAS-filename_as_file_name = filename AS file_name FIELDALIAS-md5_as_file_hash = md5 AS file_hash FIELDALIAS-refererURL_as_http_referrer = refererURL AS http_referrer FIELDALIAS-requestmethod_as_http_method = requestmethod AS http_method FIELDALIAS-serverip_as_dest_ip = serverip AS dest_ip FIELDALIAS-threatcategory_as_category = threatcategory AS category FIELDALIAS-transactionsize_as_bytes = transactionsize AS bytes FIELDALIAS-urlcategory_as_category = urlcategory AS category FIELDALIAS-useragent_as_http_user_agent = useragent AS http_user_agent REPORT-ta_builder_internal_use_kv_format_results_for_proxy_web = ta_builder_internal_use_kv_format_results_for_proxy_web category = Network & Security description = Web/Proxy Logs transforms.conf [ta_builder_internal_use_kv_format_results_for_proxy_web] DELIMS = "\t", "=" Sample output discrepancy with custom regex to extract full URL vs. URL extracted by default given above props/transforms: Sample data

wilcomply13 · ‎01-07-2022

I have an issue with a URL field being extracted improperly and failing when an ampersand is present in the URL field. Transforms indicates the following delims: DELIMS = "\t", "=" Btool run on the SH member also shows that no other extract commands or delims are identified. All fields are extracted properly except for URL fields that have an ampersand, which excludes everything beyond the ampersand for the field value.

wilcomply13 · ‎07-21-2021

I looked at this so long I didn't think about the field name for time in the lookup. I coalesced the base search and the lookup time fields and was able to resolve the issue | eval time = coalesce(_time, latestTime) | stats latest(time) as latestTime by......

wilcomply13 · ‎07-21-2021

I'm having a bit of issue with my current logic. Ideally my lookup would contain three months of data, however when this search is executed I am only receiving the previous 15 mins of data. I presumed that the 'earliest' specification would only apply to the base search and not put requirements on the inputlookup, I was incorrect. In an ideal setting the base search runs every 15 minutes and pulls in recent events, lookup is appended to the results, stats recalculates latest events for public_ips, anything older than 3months is discarded, and the lookup is updated. Can anyone advise on my time settings so that the lookup appended results are not restricted to the 15min time frame in the base search? index=firewall earliest=-15m | fields user src_host private_ip public_ip | inputlookup user_tracking.csv append=true | stats latest(_time) as latestTime by user src_host public_ip private_ip | where latestTime>relative_time(now(),"-3mon") | outputlookup user_tracking.csv

wilcomply13 · ‎06-21-2021

I've been troubleshooting an issue with a search time field extractions of a JSON field being truncated at 4096 characters. I've done a fair bit of troubleshooting the issue with no real luck. Current props.conf: KV_MODE = JSON TRUNCATE = 0 Limits.conf is at the default so that doesn't appear to be an issue at the moment. I'm also able to run makeresults with a field with a character count of 8192 with no issue, so it doesn't appear to be a global limitation. Any insight as to why this is occurring would be greatly appreciated.

wilcomply13 · ‎05-13-2021

I have a single user that is being affected by a strange issue where they are able to search, however the event table returns no content: If this user submits a search the URL appears to be malformed: https://splunkinstance.site:8000/en-US/app/search/search?dispatch.sample_ratio=1&display.events.fields=%5B%22host%22%2C%22source%22%2C%22sourcetype%22%2C%22callerIpAddress%22%2C%22category%22%2C%22tag%22%2C%22tag%3A%3Aeventtype%22%2C%22ms_Mcs_AdmPwd%22%2C%22user_login%22%2C%22user_caps%22%2C%22object_type%22%2C%22object_name%22%2C%22hist_ip%22%2C%22signature%22%2C%22error%22%2C%22sender%22%2C%22mail%22%5D&display.events.list.wrap=1&display.events.maxLines=5&display.events.rowNumbers=0&display.events.table.wrap=1&display.events.type=list&display.general.type=events&display.page.search.mode=verbose&display.page.search.tab=events&display.prefs.events.count=10&workload_pool=&q=search%20index%3Dweb&earliest=-15m&latest=now&sid=1620911471.38537_9F0273CD-B076-4A00-B73C-8A9CFED6A82A While if I issue the same search my URL: https://splunkinstance.site:8000/en-US/app/search/ search?earliest=-15m&latest=now&q=search%20index%3Dweb&display.page.search.mode=verbose&dispatch.sample_ratio=1&workload_pool=&sid=1620911758.72975_80C75F5F-836C-4502-ADC6-6F26EF89DE77 The users GET requests appear to be recalling an extensive field list even when a single index is searched: index=web | fields index I've confirmed the issue with the user in different browsers, as well as that the user has correct permissions.

wilcomply13 · ‎05-11-2021

My apologies, you are correct. I was misinterpreting the output. This is a working solution for this issue.

wilcomply13 · ‎05-11-2021

Appears that mvfind will only match against a regular expression and not a provided field: "This function tries to find a value in the multivalue field MVFIELD that matches the regular expression in 'REGEX'"

wilcomply13 · ‎05-10-2021

Unfortunately, I've no direct access to the endpoint. I've resolved the issue by putting in a secondary input stanza to account for the file path difference.

wilcomply13 · ‎05-10-2021

I've done a fair amount of searching over the forums and am still having issues with comparing multi-value fields. I'm attempting to compare src_ip for events against MV field user_known_ip. Below are the results I expect: src_user_ip src_ip KnownIP 192.168.1.1 192.168.1.2 192.168.1.1 Yes 192.168.1.3 172.16.1.3 No 192.168.1.4 192.168.1.5 192.168.1.6 172.16.1.4 No My current logic pulls in the necessary events, and does a lookup for user_known_ip: index=myindex action=user_login | lookup known_user.csv user AS src_user OUTPUT user_ip as src_user_ip | makemv delim=" " src_user_ip | mvexpand src_user_ip | eval KnownIP = if(match(src_ip, src_user_ip),"Yes", "No") | search KnownIP="No" | stats values(src_user_ip) values(src_ip) values(KnownIP) by sAMAccountName Despite this logic, I'm still having results returned from the base search that contain src_ip values that match values in the MV field src_user_ip: src_user_ip src_ip KnownIP 192.168.1.1 192.168.1.2 192.168.1.1 172.16.1.1 172.16.1.2 No 192.168.1.3 172.16.1.3 No 192.168.1.4 192.168.1.5 192.168.1.6 172.16.1.4 172.16.1.5 192.168.1.6 No src_user_ip is multi value and will have an indeterminate number of values.

wilcomply13 · ‎05-03-2021

I've been having issues with wildcarded input monitoring. In an attempt to adjust for an issue with file path naming across a number of servers. My original/working stanza. Disregard ellipses, I've shortened the path for this posting: - [monitor://D:\Program Files\Microsoft\...\MessageTracking] My adjusted/wildcarded stanzas that have not worked for input on any of our. Disregard ellipses, I've shortened the path for this posting to increase readability: - [monitor://D:\*\Microsoft\...\MessageTracking] - [monitor://D:\Prog*am Files\Microsoft\...\MessageTracking] - [monitor://D:\*Files\Microsoft\...\MessageTracking] I don't appear to receive an error message after this change, but logs completely drop off when wildcard is put into the deployed configuration.

Posts	13
Solutions	2
Karma Given	2
Karma Received	2
Member Since	‎05-03-2021

Online Status	Offline
Date Last Visited	‎01-28-2022 08:38 AM

JSON nested field extraction

Field extraction failing on ampersand

Search Time Issue

JSON Search Time Extractions Truncated

User query GET request malformed

Comparing Multivalue Fields

Issues with wildcard input stanza

JSON nested field extraction

Re: Field extraction failing on ampersand

Re: Field extraction failing on ampersand

Field extraction failing on ampersand

Re: Search Time Issue

Search Time Issue

JSON Search Time Extractions Truncated

User query GET request malformed

Re: Comparing Multivalue Fields

Re: Comparing Multivalue Fields

Re: Issues with wildcard input stanza

Comparing Multivalue Fields

Issues with wildcard input stanza

Join the Conversation