About evallja

evallja · ‎08-15-2023

Still not working... As I already spent too much time on this search I'm going with regex as below: | rex field=Previous_Time "T(?P<Previous_Time>.([0-9]+(:[0-9]+)+))" | rex field=New_Time "T(?P<New_Time>.([0-9]+(:[0-9]+)+))" and then I will use "where" for the other filtering about the exact difference I want to choose (which also shall remain anonymized). Thank you for your replies and your time! Best regards.

ITWhisperer · ‎08-07-2023

| streamstats window=2 range(_time) as gap global=f by sender receiver | eval _time=if(gap <= 3, _time-gap, _time) | stats values(subject) as subject values(attach) as attach values(receiver) as receiver by _time sender This assumes the events are in chronological order and will use the time from the earlier of the pair of events

Simple_Search · ‎07-13-2023

Try adding the following to establish the boundary of the IP and search past the ASA message. This will get the first available IP address. If this works for you please be sure to grant some karma! | rex field=_raw "ASA\-\d\-\d+\:.+?(\b(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"

PaulPanther · ‎01-10-2023

Just use eval to set up a new internal field | eval _mail_address=user + "@gmail.com," and then use this field in your alert as recipient $result._mail_address$. Finally set the trigger to "For each result" to send each line to the specific mail_address.

evallja · ‎01-09-2023

@ITWhisperer It worked, thanks a lot!!!

gcusello · ‎10-26-2022

Hi, please try this: index=flexcube [|inputlookup AUTHs.csv | fields + role_id ] [|inputlookup function_ids.csv | rename C_FUNCTION_ID AS function_id | stats dc(control_1) AS control_1_count dc(control_8) AS control_8_count values(control_1) AS control_1 values(control_8) AS control_8 BY function_id role_id | where control_1_count>1 OR control_8_count>1 Ciao. Giuseppe

gcusello · ‎09-15-2022

Hi @evallja, please try this: | rex field=Message "^Product:\s+(?<Product>[^-]+)" that you can test at https://regex101.com/r/922J2Q/1 Ciao. Giuseppe

ITWhisperer · ‎08-15-2022

| rex field=Hashes "SHA1=(?<sha1>[^,]+),MD5=(?<md5>[^,]+),SHA256=(?<sha256>[^,]+),IMPHASH=(?<imphash>.*)"

somesoni2 · ‎08-08-2022

Add this to your current search | where mvcount(recipient)>=10

richgalloway · ‎08-04-2022

Splunk's Field Extractor feature will do that, but the expressions it generates are not optimal. I have not used any other regex generators.

evallja · ‎08-01-2022

Thank you for your reply @ITWhisperer , it was very helpful. I modified two little things like below and now it is working perfectly: index=network host=device1 earliest=-7d@d latest=@d [ search index=network host=device1 earliest=-24h@h latest=@h | fields sourceip] | stats count by sourceip | where count > 2 Best regards.

Posts	19
Solutions	1
Karma Given	24
Karma Received	0
Member Since	‎01-18-2022

Online Status	Offline
Date Last Visited	‎10-24-2024 03:04 AM

How to return results only if Previous_Time and Ne...

How to merge using time range and some duplicated ...

ASA Firewall events IP extract

Configure alert to send email to a certain field v...

How to search all indexes with the specified HASH-...

How to create an alert when a field value changes?

How to extract field using regex?

Regex to extract separate hashes from Hashes field...

How to define minimum number of field values per e...

How to extract two new fields from one existing fi...

Re: Return results only if Previous_Time and New_T...

Re: merge using time range and some duplicated fie...

Re: ASA Firewall events IP extract

Re: Configure alert to send email to a certain fie...

Re: Search all indexes with the specified HASH-es ...

Re: Alert when a field value changes

Re: Exctract field using regex

Re: Regex to extract separate hashes from Hashes f...

Re: How to define minimum number of field values p...

Re: Extracting two new fields from one existing fi...

Re: How to get results from last week's data but o...

Join the Conversation