About Siddharthnegi

Siddharthnegi

Hi I want to extract highlighted part Sep 24 10:43:25 10.82.10.245 [S=217] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:242; Additional Info1:; [Time:24-09@17:43:25.248] [63380759]

Siddharthnegi

Hi i want to extract highlighted part Sep 24 10:43:25 10.82.10.245 [S=217] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:242; Additional Info1:; [Time:24-09@17:43:25.248] [63380759]

Siddharthnegi

Hi I want to extract the highlighted part RAISE-ALARM:acIpGroupNoRouteAlarm: [KOREASBC1] IP Group is temporarily blocked. IP Group (IPG_ITSP) Blocked Reason: No Working Proxy; Severity:major; Source:Board#1/IPGroup#2; local0.warning [S=2952580] [BID=d57afa:30] RAISE-ALARM:acIpGroupNoRouteAlarm: [KOREASBC1] IP Group is temporarily blocked. IP Group (IPG_ITSP) Blocked Reason: No Working Proxy; Severity:major; Source:Board#1/IPGroup#2; Unique ID:209; Additional Info1:; [Time:29-08@17:53:05.656] 17:53:05.655 10.82.10.245 local0.warning [S=2952579] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:208; Additional Info1:; [Time:29-08@17:53:05.655]

Siddharthnegi

Hi , I want to extract the color part. RAISE-ALARM:acIpGroupNoRouteAlarm: [KOREASBC1] IP Group is temporarily blocked. IP Group (IPG_ITSP) Blocked Reason: No Working Proxy; Severity:major; Source:Board#1/IPGroup#2; local0.warning [S=2952580] [BID=d57afa:30] RAISE-ALARM:acIpGroupNoRouteAlarm: [KOREASBC1] IP Group is temporarily blocked. IP Group (IPG_ITSP) Blocked Reason: No Working Proxy; Severity:major; Source:Board#1/IPGroup#2; Unique ID:209; Additional Info1:; [Time:29-08@17:53:05.656] 17:53:05.655 10.82.10.245 local0.warning [S=2952579] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:208; Additional Info1:; [Time:29-08@17:53:05.655]

Siddharthnegi

Hi , I have a saved search which is cron scheduled , but it is not showing on the saved search panel . (setting->Searches,report and alerts) what could be the reason.

Siddharthnegi · ‎09-03-2024

HI , I want to extract purple part. But Severity can be Critical as well . [Time:29-08@17:52:05.880] [60569130] 17:52:28.604 10.82.10.245 local0.notice [S=2952486] [BID=d57afa:30] RAISE-ALARM:acBoardEthernetLinkAlarm: [KOREASBC1] Ethernet link alarm. LAN port number 3 is down.; Severity:minor; Source:Board#1/EthernetLink#3; Unique ID:206; Additional Info1:GigabitEthernet 4/3; Additional Info2:SEL-SBC01; [Time:29-08@17:52:28.604] [60569131] 17:52:28.605 10.82.10.245 local0.warning [S=2952487] [BID=d57afa:30] RAISE-ALARM:acEthernetGroupAlarm: [KOREASBC1] Ethernet Group alarm. Ethernet Group 2 is Down.; Severity:major; Source:Board#1/EthernetGroup#2; Unique ID:207; Additional Info1:; [Time:29-08@17:52:28.605] [60569132] 17:52:28.721 10.82.10.245 local0.notice [S=2952488] [BID=d57afa:30] SYS_HA: Redundant unit physical network interface error fixed. [Code:0x46000] [Time:29-08@17:52:28.721] [60569133]

Siddharthnegi · ‎09-03-2024

hi i want to extract purple part. [Time:29-08@17:53:05.654] [60569222] 17:53:05.654 10.82.10.245 local3.notice [S=2952578] [SID=d57afa:30:1773434] (N 71121559) AcSIPDialog(#28)::TransactionFail - ClientTransaction(#471) failed sending message with CSeq 1 OPTIONS CallID 20478380282982024175249@1.215.255.202, the cause is Transport Error [Time:29-08@17:53:05.654] [60569223] 17:53:05.655 10.82.10.245 local0.warning [S=2952579] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:208; Additional Info1:; [Time:29-08@17:53:05.655] [60569224] 17:53:05.656 10.82.10.245 local0.warning [S=2952580] [BID=d57afa:30] RAISE-ALARM:acIpGroupNoRouteAlarm: [KOREASBC1] IP Group is temporarily blocked. IP Group (IPG_ITSP) Blocked Reason: No Working Proxy; Severity:major; Source:Board#1/IPGroup#2; Unique ID:209; Additional Info1:; [Time:29-08@17:53:05.656] [60569225] 17:53:05.657 10.82.10.245 local3.notice [S=2952581] [SID=d57afa:30:1773434] (N 71121560) AcSIPDialog(#28): Handling DIALOG_DISCONNECT_REQ in state DialogInitiated

Siddharthnegi · ‎09-03-2024

hello , i want to extract purple highlighted part. [Time:29-08@17:53:03.562] [60569219] 17:53:03.562 10.82.10.245 local3.notice [S=2952575] [SID=d57afa:30:1773441](N 71121555) #98)gwSession[Deallocated] [Time:29-08@17:53:03.562] [60569220]17:53:05.158 10.82.10.245 local3.notice [S=2952576] [SID=d57afa:30:1773434] (N 71121556) RtxMngr::Transmit 1 OPTIONS Rtx Left: 0 Dest: 211.237.70.18:5060, TU: AcSIPDialog(#28)(N 71121557) SIPTransaction(#471)::SendMsgBuffer - Resending last message[Time:29-08@17:53:05.158] [60569221] 17:53:05.654 10.82.10.245 local3.notice [S=2952577] [SID=d57afa:30:1773434] (N 71121558) RtxMngr::Dispatch - Retransmission of message 1 OPTIONS was ended. Terminating transaction... [Time:29-08@17:53:05.654] [60569222]17:53:05.654 10.82.10.245 local3.notice [S=2952578] [SID=d57afa:30:1773434] (N 71121559) AcSIPDialog(#28)::TransactionFail - ClientTransaction(#471) failed sending message with CSeq 1 OPTIONS CallID 20478380282982024175249@1.215.255.202, the cause is Transport Error [Time:29-08@17:53:05.654] [60569223]17:53:05.655 10.82.10.245 local0.warning [S=2952579] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:208; Additional Info1:; [Time:29-08@17:53:05.655] [60569224] 17:53:05.656 10.82.10.245 local0.warning [S=2952580] [BID=d57afa:30] RAISE-ALARM:acIpGroupNoRouteAlarm: [KOREASBC1] IP Group is temporarily blocked. IP Group (IPG_ITSP) Blocked Reason: No Working Proxy; Severity:major; Source:Board#1/IPGroup#2; Unique ID:209; Additional Info1:; [Time:29-08@17:53:05.656] [60569225] 17:53:05.657 10.82.10.245

Siddharthnegi · ‎09-02-2024

what if I want to remove RAISE-ALARM from staring

Siddharthnegi · ‎09-02-2024

I want to extract whole line till proxy RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy;

Siddharthnegi · ‎09-02-2024

Hi , I want to extract this line from an event. RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy;

Siddharthnegi · ‎09-01-2024

hello I am getting a field port in event . ports="['22', '68', '6556']" how can i display them in separate rows.

Siddharthnegi · ‎08-08-2024

Thank you for the quick reply , ok but few days back PDF option was not there and now it is . how is that possible?

Siddharthnegi · ‎08-08-2024

can we edit this format option ? like to remove or add PDF format . Because few days back PDF option was not showing here and now it is . Is there a way to edit it or add pdf format

Siddharthnegi · ‎08-05-2024

What if I want to download a PDF instead of csv is that possible?

Siddharthnegi · ‎08-05-2024

I want to export results of a search in pdf format but it shows

Siddharthnegi · ‎07-30-2024

ok , i have tried it and it does not work

Siddharthnegi · ‎07-30-2024

Thank you for the reply , but that name should be "report" not "my report"

Siddharthnegi · ‎07-30-2024

Hello, I have a app and this is its default XML <nav search_view="search" color="#65A637"> <view name="search" default="true"/> <view name="securehr"/> <view name="secure_group_members"/> <view name="changes_on_defined_secure_groups"/> <view name="group_membership"/> <view name="group_membership_v2"/> <collection label="Reports"> <view name="SecureFolder-Report for APT" >Report for APT</view> <view name="SecureFolder-Report for Betriebsrat" default="true">Report for Betriebsrat</view> <view name="SecureFolder-Report for CMA" default="true">Report for CMA</view> <view name="SecureFolder-Report for HR" default="true">Report for HR</view> <view name="SecureFolder-Report for IT" default="true">Report for IT</view> <view name="SecureFolder-Report for QUE" default="true">Report for QUE</view> <view name="SecureFolder-Report for Vorstand" default="true"> Report for Vorstand</view> </collection> </nav> Now from this xml ir should show 7 sections on navigation panel. But it does not show report section , can anyone help?

Siddharthnegi · ‎07-11-2024

I have 2 lookups . first lookup have multiple fields including Hostname and the second lookup have only Hostname field . I want to find common Hostname from both lookups ,How can i do that?

Siddharthnegi · ‎07-11-2024

How can i do that?

Siddharthnegi · ‎07-11-2024

yes thats why I am inner join devices.csv to other csv file. The Hostname in device.csv will match some Hostname from first search

Siddharthnegi · ‎07-11-2024

first search have multiple fields including Hostname , and second search only have Hostname . So I am trying to inner join to get more fields for Hostname in device.csv. Does that make sense?

Siddharthnegi · ‎07-11-2024

why is inner join not working , Both searches are giving results. | inputlookup ABCD.csv | eval CC=mvdedup(CC) | rename CC as "Company Code" | streamstats first(lastchecked) as scan_check | eval key=_key,is_solved=if(lastchecked>lastfound OR lastchecked == 1,1,0),solved=finding."-".is_solved."-".key,blacklisted=if(isnull(blfinding),0,1),scandate=strftime(lastfound,"%Y-%m-%d %H:%M:%S"),lastchecked=if(lastchecked==1,scan_check,lastchecked),lastchecked=strftime(lastchecked,"%Y-%m-%d %H:%M:%S") | fillnull value="N.A." Asset_Gruppe Scan-Company Scanner Scan-Location Location hostname "Company Code" | search (is_solved=1 OR is_solved=0) (severity=informational) blacklisted=0 Asset_Gruppe="*" Scan-Company="*" Location="*" Scanner="*" dns="*" pluginname="*" ip="*" scandate="***" "Company Code"="*" | rex field=scandate "(?<new_date>\A\d{4}-\d{2}-\d{2})" | sort 0 -new_date | eventstats first(new_date) as timeval | rex field=new_date "-(?<date_1>\d\d)-" | rex field=timeval "-(?<date_2>\d\d)-" | strcat finding "#" NessusHost sid hostid pluginid finding | where date_1=date_2 | fields dns ip lastchecked severity pluginid pluginname scandate Asset_Gruppe Location Scan-Company "Company Code" Scan-Location solved Scanner finding | rename dns as Hostname,ip as IP | join type=inner Hostname [|inputlookup device.csv | table Hostname]

Siddharthnegi · ‎07-09-2024

How to get all saved searches with their names and their respective search

Posts	106
Solutions	0
Karma Given	46
Karma Received	0
Member Since	‎06-06-2023

Online Status	Offline
Date Last Visited	a week ago

regular expression

regular expression

Regx

regx

saved search

Regular Expression

Regular Expression

regular expression

regx

data extraction

regular expression

regular expression

Regx

regx

saved search

Regular Expression

Regular Expression

regular expression

Re: regx

Re: regx

regx

data extraction

Re: File Format

File Format

Re: Export to csv on click of button

Export

Re: Navigation

Re: Navigation

Navigation

common fields

Re: Inner join

Re: Inner join

Re: Inner join

Inner join

saved searches