About msalghamdi

msalghamdi

hello Splunkers i have a requirement where i need to show values in statistics even if it doesn't exist, for example here's my search: index=brandprotection name IN (ali, ahmad, elias,moayad) | stats count by brand however sometimes in the logs Elias and Moayad names isn't there but i need to have it in the table, so i need the output to be like this user count ahmad 7 ali 4 elias 0 moayad 0 i need a search that would show the results like the table above. thanks

msalghamdi · ‎10-01-2024

Hello. the field in my search is "file_name" while the field in the lookup is called "phrase", i tried to use this but it didnt work: | lookup my_lookup.csv phrase OUTPUT file_name AS found_key

msalghamdi · ‎10-01-2024

thanks for the prompt response. our risk team wants to provide a list of critical project keyword which will be stored as a lookup, and we'd search the DLP logs for any match in the lookup, but the require that the analyst shouldn't have the ability to view the lookup which means that the analyst wouldn't know what keyword matched if the DLP captured more that a file/keyword in one log, so we thought if maybe there's a way we can highlight matched keywords in the search

msalghamdi · ‎10-01-2024

Hello Splunkers How can i utilize a lookup in a correlation search showing the detected keyword in the search result ? its a requirement that the analyst shouldn't have the capability to view lookups Thanks in advance.

msalghamdi · ‎07-24-2024

Hello Splunkers i have clustered splunk 9.2.1 on prem, i have pushed an app from the CM to search head cluster and trying to configure a data input through the search head (option is not available from the CM) whenever i add a data input i always face this error "Current instance is running in SHC mode and is not able to add new inputs" how can i fix this ?

msalghamdi · ‎06-11-2023

Hello Splunkers. i need your help in creating a search that would count number of values for a field in a month and then compare it to a 3months average of the same results. thanks

msalghamdi · ‎06-11-2023

thanks for the answer, the thing is whenever i create results, the same fields gets overwritten when i create multiple of it, please if you can create a search that would show it in a table id be thankful

msalghamdi · ‎06-11-2023

Dear Splunker, i need you help in creating custom results to include in a report and output it in a table for statistics, here are the data: Thanks in advance

msalghamdi · ‎06-11-2023

it worked, thanks

msalghamdi · ‎06-11-2023

Hello Splunkers i need your help in creating a search to count number of alerts by months that would fit in a column chart thanks

msalghamdi · ‎05-23-2023

thanks javiergn one more question please, i want to apply a condition on the extracted field that is must exist, here's my search: index=proxy | rex field=url "http[s]?:\/\/[\w]{1,}\.[\w]{1,}\/(?<ppp>[0-9a-z]{10})$" | where ppp=* | table _time src dest_ip dest user ppp url status but i get this error: Error in 'where' command: The expression is malformed. An unexpected character is reached at '* '. what can i do to fix this ? thanks

msalghamdi · ‎05-23-2023

Hello Splunkers, i want to to extract a 10-digit path from a url but unfortunately i always get this error: Error in 'rex' command: The regex '.*\/(([0-9a-z]{10}))' does not extract anything. It should specify at least one named group. Format: (?<name>...). how ever, i want to extract the path from this URL https://example.com/8a2a6063b3 this is the search i used index=FP_proxy | rex field=url "http[s]?:\/\/[a-zA-Z0-9-]{1,}\..*\/(([0-9a-z]{10})?<url__path>)" your help is much needed and appreciated to fix this issue

Posts	12
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎05-17-2023

Online Status	Offline
Date Last Visited	4 weeks ago

show value in statistics where it doesnt exist in ...

Lookup search wigh showing matched keyword

Addig data input

How to compare current month count to a 3 months a...

How to create custom results?

How to count monthly number of alerts in enterpris...

How to apply regex to a field?

show value in statistics where it doesnt exist in ...

Re: Lookup search wigh showing matched keyword