About f_666dhn

f_666dhn · ‎08-13-2024

I have lookup file bad_domain.csv baddomain.com baddomain2.com baddomain3.com Then i want to search from proxy log, who people connect to bad domains in my lookup list. But include subdomains. Example: subdo1.baddomain.com subdo2.baddomain.com subdo1.baddomain2.com Please help, how to create that condition in spl query?

f_666dhn · ‎04-19-2023

I have an example data on csv named invent.csv like this: I want to map ip values to host output using lookup using lookup, logic example: input -> ip = 1.1.1.1 -> lookup to invent.csv -> output -> table hostname = host1 Thanks. *Sorry for my bad eng 😁

f_666dhn · ‎04-05-2023

Thanks

f_666dhn · ‎04-05-2023

I have field log-sshd like this: log-sshd="Apr 5 xx:xx:xx serverhost sshd[xxxx]: Failed password for user xxx from xx.xx.xxx.xx port xxxx ssh2" What is the SPL search if i just wanna get the word that i bolded ?

f_666dhn · ‎08-05-2022

I have field user-agent like this user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36\r\nHost: domain.com\r\nConnection: Keep-Alive\r\n" How's the SPL query, if I just wanna get the "domain.com". Thanks.

Posts	5
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎08-05-2022

Online Status	Offline
Date Last Visited	‎08-13-2024 05:12 AM

Search domain in lookup

How would I value map ip addresses?

Regex for getting only the bold?

How to write rex to get "domain.com"?

Search domain in lookup

How would I value map ip addresses?

Re: Regex

Regex for getting only the bold?

How to write rex to get "domain.com"?

Are you a member of the Splunk Community?