Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About danutmatei
danutmatei
Explorer
Member since:
09-23-2021
03-13-2023
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 09-23-2021 |
Activity Feed
- Posted Re: Compare index with inputlookup on Splunk Search. 03-13-2023 06:13 AM
- Posted Re: Compare index with inputlookup on Splunk Search. 03-13-2023 06:04 AM
- Tagged Re: Compare index with inputlookup on Splunk Search. 03-13-2023 06:04 AM
- Posted Re: Compare index with inputlookup on Splunk Search. 03-13-2023 05:43 AM
- Posted Re: Compare index with inputlookup on Splunk Search. 03-13-2023 05:29 AM
- Posted Re: Compare index with inputlookup on Splunk Search. 03-13-2023 04:51 AM
- Tagged Re: Compare index with inputlookup on Splunk Search. 03-13-2023 04:51 AM
- Posted Comparing index with inputlookup? on Splunk Search. 03-13-2023 04:20 AM
- Posted Re: earliest and latest in inputlookup on Splunk Search. 02-23-2023 07:59 AM
- Posted Re: earliest and latest in inputlookup on Splunk Search. 02-23-2023 07:49 AM
- Posted Re: earliest and latest in inputlookup on Splunk Search. 02-23-2023 07:32 AM
- Posted How to compare earliest and latest in inputlookup? on Splunk Search. 02-23-2023 07:02 AM
- Tagged How to compare earliest and latest in inputlookup? on Splunk Search. 02-23-2023 07:02 AM
- Tagged How to compare earliest and latest in inputlookup? on Splunk Search. 02-23-2023 07:02 AM
- Tagged How to compare earliest and latest in inputlookup? on Splunk Search. 02-23-2023 07:02 AM
- Posted How to compare data from data model with data from data set? on Splunk Search. 02-22-2023 07:35 AM
- Posted Re: How can I whitelist based on this 3 conditions- where condition with 3 arguments? on Splunk Search. 10-19-2022 03:53 AM
- Karma Re: where condition with 3 arguments for ITWhisperer. 10-19-2022 03:53 AM
- Posted How can I whitelist based on this 3 conditions- where condition with 3 arguments? on Splunk Search. 10-17-2022 03:58 AM
- Posted How can I exclude list of IPs? on Splunk Search. 08-18-2022 07:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-13-2023
06:13 AM
And what should I do with this query ? since is not solving my issue and the lookup file is not included ?!
... View more
03-13-2023
06:04 AM
|tstats count where index=events by user
| lookup policy.csv user
... View more
- Tags:
- stats
03-13-2023
05:29 AM
Error in 'lookup' command: Must specify one or more lookup fields.
... View more
03-13-2023
04:20 AM
Hi,
I have a policy.csv file with 2 columns:
user tags
Andre IT
Kleo Management
Vlad Finance
And I also have an index=events with events and field "user"
What I want is to count the number of events for each tag by user.
for example:
User Tags Count
Andre IT 55
I've tried this, but it counts the number of rows from the csv, not from index:
|inputlookup policy.csv
| join type=left tags [|tstats count where index=events by user]
|stats count by user tags
... View more
02-23-2023
07:49 AM
It's working, but what if, for example I want data starting from 7 days ago till 30 days ago ?
... View more
02-23-2023
07:32 AM
this is what I have: .... some data where action=allowed AND [|inputlookup intelligence.csv |eval hash=indicator |fields hash] That is working, but for example I don't want to compare hashes added 60 days a go. I want for example, hashes added in the last 7 days ..
... View more
02-23-2023
07:02 AM
Hello,
I have a .csv file with 2 columns: IoC and added_timestamp
I did compare the data and I get a few matches, but what I want is to use just a portion of the .csv. Based on added_timestamp column I want to compare the IoC added in .csv in the last 7 days.
Can someone help me to accomplish this ?
Thank you in advance.
... View more
Labels
- Labels:
-
lookup
02-22-2023
07:35 AM
Hello, I have a data model named firewall_logs with firewall data in which the interesting fields are: file_hash, url and source/dest IP.
And I have a dataset named intel_indicators with column named ioc in which I have hashes, IPs, domains and timestamp.
What I want to do is to compare the data (hashes, IPs, domains) from ioc column with the fields: file_hash, url, dest_ip. If there is a match, it should be visible.
Any ideea how I can accomplish this ?
| tstats summariesonly=t allow_old_summaries=t ...interesting fields.... from datamodel="firewall_logs" a
and here I'm stuck
... View more
- Tags:
- data model
Labels
- Labels:
-
field extraction
-
lookup
-
stats
-
tstats
10-19-2022
03:53 AM
working like a charm, thank you
... View more
10-17-2022
03:58 AM
Hi, I have an inputlookup with wSender, wSubject and wRecipient. I want to whitelist some of the emails sent by an user to a specific recipient that have a specific subject.
How can I whitelist based on this 3 conditions (Sender=X, Subject=Y, Recipient=Z) ?
I've tried: where Sender!=wSender AND Subject!=wSubject AND Recipient!=wRecipient but in this case all the email sent by wSender are whitelisted.
Also tried index=xxx AND NOT | inputlookup whitelist.csv fields wSender, wSubject, wRecipient - but the same result, the user from wSender is getting whitelisted for all the emails he sent not just the ones from wSubject.
... View more
Labels
- Labels:
-
lookup
08-18-2022
07:37 AM
Hello,
I have a .csv with 2 columns: hostname and ip.
How can I exclude the IPs from that list ?
Tried something like this, but it doesn't work: src_ip="[|inputlookup ip_list.csv | fields ip]"
... View more
Labels
- Labels:
-
other
08-03-2022
05:08 AM
If I have the logs from a data model, can I use this ? from datamodel=firewall_logs where NOT (source="X" (destination="Y" OR destination="Z")) thank you
... View more
08-03-2022
02:26 AM
Hello, I'm working on a use case where I have 1 source and 2 destinations. Everything that is found between the source and the 2 destinations need to be excluded. So I've used:
where source = X AND destination != Y OR destination != Z
But this will filter the logs and will display only the logs that comes from source X and the logs that comes from other sources will be excluded as well.
How I can exclude only from source X to destination Y and Z ?
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-13-2023
10:28 AM
|
