About bimatomsoc

bimatomsoc · ‎11-29-2023

Thank you very much, Sir. Finally, I got the solution based on your suggestion. I put the filename column and value in the csv file. That is the easy way to get the lookupfilename in search.

bimatomsoc · ‎11-29-2023

Thanks for your response. It's really helpful and knowledgeable. Your rest query can get the lookupfilename as title. Actually, my original search query is - | inputlookup abc.csv | rename field1 as new_field | append [| inputlookup def.csv | rename field1 as new_field] | table new_field When I put rest query that you provided, "rest" must be the first place in search. I do want to know how to combine my original query and rest query to get the new_field and lookupfilename.

bimatomsoc · ‎11-29-2023

I want to get my inputlookup csv filename with the query. | inputlookup abc.csv | stats count by inputlookup_filename ```<= the result I needed is "abc"``` Or | table inputlookup_filename ```<= the result I needed is "abc"```

bimatomsoc · ‎09-17-2023

Thank you for your quick response. Your query makes sense for me. But, it doesn't fully work. I think we should change the whole search. The function I used "coalesce" collects the first field value. If the dest value is not null, it only collects the dest, not collecting the rest of the values like src, src_ip. As far as I researched, I think I should use lookup and OUTPUT function to matches all the IPs(src, dest,..) with lookup index's IPs.

bimatomsoc · ‎09-17-2023

There are some values of IP addresses from `cim_Authentication_indexes`. This index is for look up. I want to make if the IP addresses from `cim_Authentication_indexes` are in the second lookup index. I tried making some query but it quite something wrong. (`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$) | table dest, dst, Ip, source_ip, src_ip, src | eval IP_Addr = coalesce(dest, dst, Ip, source_ip, src_ip, src) | append [search index="tml_it-mandiant_ti" type=ipv4 | table value] | stats count by IP_Addr, value | where count >= 1 Please correct this and help me out. Thanks.

bimatomsoc · ‎08-14-2023

Yes, "threathunting" index is empty and created to collect search results. No error in splunkd.log

bimatomsoc · ‎08-14-2023

Yes, it was found in _internal index. Also, this is a cluster environment. We have access to file system but there is no *_events.stash_new file under the /opt/splunk/var/spool/splunk/ directory.

bimatomsoc · ‎08-13-2023

Setting>Indexes>threathunting It's enabled, deployed in the Global sharing permissions app. It also has home path for db.

bimatomsoc · ‎08-13-2023

Successfully wrote file to '/opt/splunk/var/spool/splunk/b90a7184a4568807_events.stash_new'.

bimatomsoc · ‎08-13-2023

Yes, the original command without |collect is working fine and gets results. index="main" |table host index tag |head 10 Till this command, it shows the results with table. When I put the collect command, the search run has no error, still showing the head 10 results. |collect index="threathunting" But, the results are not collected in the "threathunting" index. I already created a empty "threathunting" index, get permission and accessible index. So, the head 10 results should be collected in "threathunting" index. Yet, it can't.

bimatomsoc · ‎08-13-2023

Yes, the original command without |collect is working fine and gets results. index="main" |table host index tag Till this command, it shows results as table.

bimatomsoc · ‎08-13-2023

We have a new index named "threathunting" and having permission to collect the results. We use splunk admin account. How do we check that we have permission to run collect command?

bimatomsoc · ‎08-13-2023

We cannot use "collect" command Please see my example search: index="main" |table host index tag |collect index="custom_index" It didn't work. No results were collected in "custom_index"

Posts	14
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎03-15-2023

Online Status	Offline
Date Last Visited	‎09-18-2024 04:46 AM

How to extract filename from inputlookup csv file ...

Lookup search from another index

Re: How to extract filename from inputlookup csv f...

Re: How to extract filename from inputlookup csv f...

How to extract filename from inputlookup csv file ...

Re: Lookup search from another index

Lookup search from another index

Re: Alternate command for collect

Re: Alternate command for collect

Re: Alternate command for collect

Re: Alternate command for collect

Re: Alternate command for collect

Re: Alternate command for collect

Re: Alternate command for collect

Re: Alternate command for collect

Are you a member of the Splunk Community?