About Merryvor

Merryvor · ‎09-30-2024

Hi @ITWhisperer, the request is great ! it's working fine in the search indeed. Unfortunately it doesn't work within a dashboard source code : first line is highlighted with the message "unencoded <" | rex mode=sed field=origData "s/<(?<!)/ </g s/>(?=<)/> /g" it there a way to make the request understandable in dashboard UI ?

Merryvor · ‎09-09-2024

Hello, I have a table with several fields that I display in a dashboard. One column is from violation_details field, which contains XML data. Note that I don't want to parse anything from this field, because depending on the violations the tags won't be the same. Here is an example of a value for this field <?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>58f7c3e96a0c279b-7e3f5f28b0000040</block><alarm>5cf7c3e97b0c6fdb-7e3f5f28b0000040</alarm><learn>5cf2c1e9730c2f5b-3d3c000830000000</learn><staging>0-0</staging></violation_masks><response_violations><violation><viol_index>56</viol_index><viol_name>VIOL_HTTP_RESPONSE_STATUS</viol_name><response_code>500</response_code></violation></response_violations></BAD_MSG> How could I make this more readable like this : <?xml version='1.0' encoding='UTF-8'?> <BAD_MSG> <violation_masks> <block>58f7c3e96a0c279b-7e3f5f28b0000040</block> <alarm>5cf7c3e97b0c6fdb-7e3f5f28b0000040</alarm> <learn>5cf2c1e9730c2f5b-3d3c000830000000</learn> <staging>0-0</staging> </violation_masks> <response_violations> <violation> <viol_index>56</viol_index> <viol_name>VIOL_HTTP_RESPONSE_STATUS</viol_name> <response_code>500</response_code> </violation> </response_violations> </BAD_MSG> I've seen this POST XML-to-display-in-a-proper-format-with-tag but it seems to use a deprecated method. Is there a better way ?

Merryvor · ‎09-06-2024

Thank you @bowesmana I actually tried this before | stats count as attack_number by FQDN,uri values(attack_type) as "Types of attack" but it didn't return anything. However this is working : | stats values(attack_type) as "Types of attack" count as attack_number by FQDN,uri I guess this way the by clause applies to both count and values function. seems logic now that I see it !

Merryvor · ‎09-06-2024

Hello, I'm trying to obtain a table like this : FQDN uri list of attack_types attack_number www.test.com /index Information Leakage Path Traversal 57 www.test.com /test Path Traversal 30 prod.com /sample Abuse of Functionality Forceful Browsing Command Execution 10 I can obtain the table without the list of attack_types, but I can't figure out how to add the values function. | stats count as attack_number by FQDN,uri | stats values(attack_type) as "Types of attack" For each FQDN/uri I want to have the number of attacks, and all the attack_types seen. It seems obvious, but I'm missing it. Can someone help me ?

Merryvor · ‎07-18-2024

yes seems fine now ^^ I used the lookup definition in the lookup command thank you !

Merryvor · ‎07-18-2024

@PickleRick I have nothing created in the new field "match". I suspect this is because of the wildcard in the lookup field somehow. I tried to had a lookup definition on the domain.csv to have WILDCARD(domain), no luck either

Merryvor · ‎07-18-2024

Hello, I would like to obtain a list of all domains that did NOT match my lookup file which is composed of wildcard domain here is an example : Lookup file domain *adobe.com* *perdu.com* Events index=proxy | table dest dest acrobat.adobe.com geo2.adobe.com Result wanted *perdu.com* My request looks like this index=proxy | dedup dest | table dest | eval Observed=1 | append [| inputlookup domain.csv | rename domain as dest | eval Observed=0] | stats max(Observed) as Observed by dest | where Observed=0 Obtained results : *adobe.com* *perdu.com* because the request didn't count the lines acrobat.adobe.com and geo2.adobe.com as duplicates of *adobe.com* So what I need is a way to dedup the events based on the dest field matched from the lookup, and rename the dedup dest value like the wildcard domain field in the lookup. This way, mid request I would have these results : dest observed *adobe.com* 1 ==> from the events *adobe.com* 0 ==> from the lookup *perdu.com* 0 ==> from the lookup then stats(max) and where to get only the wildcard domains that never matched. how could I achieve that ?

Posts	7
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎07-18-2024

Online Status	Offline
Date Last Visited	‎11-18-2024 12:55 PM

display value of field with xml readable format

having stats count and stats values combined

dedup on wildcard field from a lookup

Re: display value of field with xml readable forma...

display value of field with xml readable format

Re: having stats count and stats values combined

having stats count and stats values combined

Re: dedup on wildcard field from a lookup

Re: dedup on wildcard field from a lookup

dedup on wildcard field from a lookup

Are you a member of the Splunk Community?