About karu0711

karu0711 · ‎10-31-2023

I have lookup table in splunk. I want check if ever been update in Splunk using output lookup command

karu0711 · ‎10-31-2023

my DN field value "cn=jsuwus, jkhzdhkjc,ou=sdsfefv accounts,ou=ffdsrew users,dc=hgsywy,dc=tre,dc=hyt,dc=kuhytr" I need rex to extract anything after "="and end ",ou=" if it see "=" need to stop two letter and "," so in this instance cn field as "first_field" value="jsuwus, jkhzdhkjc" ou field as "2_field" value="sdsfefv accounts" ou field as "3_field" value="ffdsrew users" dc field as "4_field" value="hgsywy" dc field as "5_field" value="tre" dc field as "6_field" value="hyt" dc field as "7_field" value=kuhytr" Thanks in advance

karu0711 · ‎10-27-2023

Is this possible to get source which sending the data or IP of the source. If it possible. Thanks

karu0711 · ‎04-14-2023

but I want only output new finding separate table and old in separate table.

karu0711 · ‎04-14-2023

I am running search. basesearch |eventstats count values(date) as Date by ID result I get count 2 or 3 or 1 how do I get count=1 OR count=3. how I use max(count) and min(count). I need this because min(count) will new data and max(count) will old data. Is there any other way to do this?

karu0711 · ‎04-12-2023

I got the not matching ID but I am getting out put table with only Date ID Name field is not populating.

karu0711 · ‎04-11-2023

I have lookup table like Date ID Name 02/04 12547 xxx 02/04 12458 xxx 02/04 14587 xxx I am running basesearch | table Date ID Name Date ID Name 02/08 12547 xxx 02/08 12458 xxx 02/08 45896 xxx 02/08 47523 xxx I want to compare my search table to lookup table and output the not match result to my search table. I try selfjoin it didnot work. Is any otherway I can do?

karu0711 · ‎03-31-2023

I want above html email body field to look like below text. how do I configure sourcetype parse the data properly. Dear [User],   I am writing to provide you with an update on the recent test email incident that occurred. If you have any questions or concerns, please do not hesitate to contact our team. Thank you for your attention to this matter. Sincerely,    

karu0711 · ‎03-31-2023

<html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="Generator" content="Microsoft Word 15 (filtered medium)"><style>  </style></head><body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word"><div class="WordSection1"> Dear [User],  I am writing to provide you with an update on the recent test email incident that occurred. If you have any questions or concerns, please do not hesitate to contact our team. Thank you for your attention to this matter. Sincerely,   </div></body></html><div class="">Above format I get my body of the email in Splunk body field How do I get this to look like below in Splunk. What should you in Line breaker configuration sourcetype? Dear [User],  I am writing to provide you with an update on the recent test email incident that occurred. If you have any questions or concerns, please do not hesitate to contact our team. Thank you for your attention to this matter. Sincerely,   </div>

karu0711 · ‎03-23-2023

I need to create separate so I can count and create dropdown to search. DEMO XXX CCC

karu0711 · ‎03-23-2023

Data field "FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147" from this I need to extract "DEMO XXX CCC" output subject field "DEMO XXX CCC"

karu0711 · ‎03-23-2023

thank it work. I also need to rex "dem" as separate field as name.

karu0711 · ‎03-23-2023

I want to extract 5degit. number 54879 as number field

karu0711 · ‎03-21-2023

FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147 I also need to separate [ DOC 45] as category DTP as type demo xxx ccc as call

karu0711 · ‎03-20-2023

FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147 I want to extract number after pie as field name "data". what is the regex?

karu0711 · ‎03-15-2023

I want to blacklist "filtered__results.json" file and allow to ingest by Splunk anything "filtered__results.json265964694" How do I do ? what is correct Rex for blacklisting "filtered__results.json"

karu0711 · ‎02-15-2023

02-10-2022 09:00:35.120 -0500 INFO TailingProcessor [5728 MainTailingThread] - Adding watch on path: C:\.

karu0711 · ‎01-10-2023

I am uploading DevOps scan result to Splunk, and these scans also have new result and some old flaw that not remediated. How can I match events and return unique. example SPL Index= demo sourcetype= demoscan table date, aaa, ccc, xxx, yyy, zzz

karu0711 · ‎01-09-2023

my url look like https://google.demo.com/sites/demo/support/shared.demo/dump/ I want to regex https://google.demo.com/sites/demo/support/ what rex

karu0711 · ‎01-04-2023

karu0711 · ‎01-04-2023

karu0711 · ‎11-30-2022

which query I use this?

karu0711 · ‎11-30-2022

I am trying to accomplish here is getting all the event value in same row. when I you the table command ther is no row separation each event. Is there any way I can accomplish without using mvzip or mvexpand. and field also need to be searchable form dashboard.

karu0711 · ‎11-30-2022

It still putting the field together. But when I use the Below SPL it is separating the fields as I want but first two felids are repeating first event field value. Why is this happening? index=main sourcetype="ms.356" | eval nested_payload=mvzip(flaw, solution, "--") | mvexpand nested_payload | eval flaw=mvindex(split(nested_payload,"--"),1) | eval solution=mvindex(split(nested_payload,"--"),0) | eval nested_payload=mvzip(answer, COE, "--") | mvexpand nested_payload | eval answer=mvindex(split(nested_payload,"--"),1) | eval COE=mvindex(split(nested_payload,"--"),0) | table flaw solution answer COE

karu0711 · ‎11-30-2022

Flaw field The application calls the javax.servlet.jsp.JspWriter.print() function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. Solution field Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary Answer field https://cwe.mitre.org/data/definitions/209.html

Posts	54
Solutions	0
Karma Given	31
Karma Received	0
Member Since	‎10-17-2022

Online Status	Offline
Date Last Visited	‎02-28-2024 02:05 PM

how do I check if a lookup table get updated with ...

I need help with rex ad DN field.

How do I find what host sending event to Splunk us...

Is there another way to use min max?

How to compare my search table to lookup table and...

html event line_break configuration?

I need to extract field call "subject" from data f...

What is regex for dem_d54879.csv?

What is regex for below?

How do I blacklist "filtered__results.json" in fil...

how do I check if a lookup table get updated with ...

I need help with rex ad DN field.

How do I find what host sending event to Splunk us...

Re: min max

Is there another way to use min max?

Re: Lookup

How to compare my search table to lookup table and...

Re: html event line_break configuration?

html event line_break configuration?

Re: I need to extract field call "subject" from da...

I need to extract field call "subject" from data f...

Re: what is regex for dem_d54879.csv

What is regex for dem_d54879.csv?

Re: what is regex for below?

What is regex for below?

How do I blacklist "filtered__results.json" in fil...

Why am I getting this error?

I want to compare events upload to Splunk in two d...

What is regex for website URL? regex

Why splunk is indexing only o365:management:activi...

Why do events duplicate when I use table command?

Re: I need to put 4 field in table view but some f...

Re: I need to put 4 field in table view but some f...

Re: I need to put 4 field in table view but some f...

Re: I need to put 4 field in table view but some f...

Join the Conversation