Hi, I am trying to build a correlation that matches traffic to threat intel to figure out if it has been blocked or not. It looks like this: Threat intel -> provides only information that given IP is malicious and recommends blocking. Thats it. Traffic logs -> provides info on traffic that actually happened, both incoming and outgoing. Lets say that threat intel tells me that ip 1.2.3.4 is malicious. I do the following search:  `index=all_traffic sourcetype=traffic "1.2.3.4"` It shows me the IP in half/half src and dest fields, and other one is my own ip, as well as if this traffic has been dropped or not in a field called action I need to automate this process to show me traffic containing suspicious ip. I tried to join the following way: `[...getting data from threat intel...] | table suspicious_ip | join suspicious_ip [ search index=all_traffic sourcetype=traffic  | rename src as suspicious_traffic ]` This works only sometimes and for half of the cases, as it only looks as src and not dest. And it gets truncated because of subsearch limit. I also tried to connect them via parenthesis like this: `( from datamodel:"Threat_Intel"."Threat_Activity" ) AND (index=all_traffic sourcetype=traffic ) | stats values(*) as * by src, dest` But this didn't work because I cannot use from datamodel this way. My ideal output would be: suspicious_ip src dest action Any ideas? ... View more

Hi, I am working on a way to find an orphaned asset based on asset inventory I have in a lookup, which looks something like this: assetname, owner, os asset-01-abc, bob, win10 asset-03-abc, bob, win10 and I was able to find out in a different search that there exists asset "asset-02-abc" - an orphan - which is not present in the lookup. So far I managed to transform the orphan name to "asset-*-abc", and I would like to create a search that would map that asset to the lookup and output something like this: siblingassets, orphanedasset, owner asset-01-abc asset-03-abc, asset-02-abc, bob I tried the following:     [...search which created the orphaned asset list...] |table orphaned_asset_originalname orphaned_asset_wildcarded | map [|inputlookup assets | search assetname="$orphaned_asset_wildcarded$" | table assetname, "$orphaned_asset_full_name$" owner]     But it doesn't output correctly, and I also tried using lookup but it simply didnt output anything Thank you ... View more

Hi, I am trying to find a way to replace numbers in strings with an asterisk, if they are concatenated with one, and if not then also with one, using rex field, example: AA-1234-12-A BB-1-132-B-1 56-CC-1-345 to be replaced with: AA-*-*-A BB-*-*-B-* *-CC-*-* I tried multiple sed commands from the internet but they either don't work properly in splunk or do not solve my issue in the exact. Many thanks ... View more

Hi, is there a way to search for more than one appearance of a pattern in a string? For example: Command cmd.exe c:\windows\\\\\\\\sytem32\[...] cmd.exe c:\windows\sytem32\[...] I would want to search for rows with more than single consecutive "\" , in case of above only first row to be returned. ... View more