About dilenthakuri

dilenthakuri · ‎06-21-2021

Thank you @richgalloway What do you mean by 'Outside of the Dashboard'? Sorry

dilenthakuri · ‎06-20-2021

Thanks @richgalloway ! So "Base Searches" you mean just run the below query first sourcetype="WinEventLog" EventCode=4688 And then, look for the field that can be appended to the search query further? Otherwise, it's not possible to remember or memorise ALL the field values while building the query. I see multiple of like below parameters set in the query: Process_Command_Line CommandLine ParentCommandLine Image ParentImage TargetFilename User Or, we just have to know all of these by heart? What's the method you guys use to build complex queries? Thank you.

dilenthakuri · ‎06-20-2021

Hi Guys, I am just wondering if anyone can put me in the right direction - I have a question about search queries in Splunk. For example, in the below 2 simple query: A. sourcetype="WinEventLog" EventCode=4688 New_Process_Name="*powershell.exe" | stats count by New_Process_Name, Process_Command_Line B. sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational” EventID=1 Image=”*powershell.exe” | stats count by Image, CommandLine How do I know the following fields exists in that particular log? 1. New_Process_Name 2. Process_Command_Line 3. Image etc. Thanks guys!!

Posts	3
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎06-20-2021

Online Status	Offline
Date Last Visited	‎06-21-2021 10:39 AM

building search query

Re: building search query

Re: building search query

building search query