So, I've been away from Splunk for several years now, and now re-visiting it.  I've got a scenario where I would like to track certain metrics from imported data.  I created a simple CSV with just a few entries to demonstrate the issues I'm having. Below is the source data I created: customer_id Time customer_fname customer_lname products product_prices 111 12/1/2023 John Doe product_100,product_200 100,200 222 12/11/2023 Suzy Que product_100 100 333 12/15/2023 Jack Jones product_300 300 111 12/18/2023 John Doe product_400 400   In this scenario this is just examples of customers and the items they purchased and the price paid.   After uploading the file and displaying the data in a table it looks as expected: source="test_sales.csv" | table customer_id,customer_fname,customer_lname,products,product_prices Upon using makemv to convert "products" and "product_prices" to multi-value fields, again the results are as expected and the product and price align since they were input into the source CSV in the proper order: source="test_sales.csv" | makemv delim="," products | makemv delim="," product_prices | table customer_id,customer_fname,customer_lname,products,product_prices   Here is where my issue is,  Is there a way to tie the product for a purchase transaction  in the multi-value "products" column to it's corresponding price in the multi-value "product_prices" column? Everything seems to work except when I try to so something like listing the products by price for the multi-value fields like this: source="test_sales.csv" | makemv delim="," products | makemv delim="," product_prices | stats count(products) by products,product_prices In the above results you can see that I'm getting results that are not exactly what I would want.  Ex.  it shows: 3 instances of product_100 at a price of 100, should only be 2 instances 2 instances of product_100 at a price of 200, should be 0 instances of this combination 2 instances of product_200 at a price of 100, should be 0 instances of this combination 2 instances of product_200 at a price of 200, should only be 1 instance   I'm likely approaching this incorrectly or using the wrong tool for the task,  any help to get me on the right track would be appreciated.   Thanks ... View more

So, we've built several alerts based on the MITRE ATT&CK Framework and have them set to send an email when a search has a hit. Now naturally the next step is that management wants us to tag those alerts with the MITRE framework as the source according to the technique alerted on in order to create a dashboard and provide metrics such as how many ATT&CK based alerts have we had per month etc... We're kinda stuck as to how to enrich the alerts with this type of categorization/tagging within Splunk. Any suggestions on a method or add on that may help with this? ... View more

For some reason I'm hitting a wall on the logic of this search. I'm working with Palo Alto logs and the fields i'm interested in are the bytes and category fields. Essentially I would need to sum the total bytes for all categories over a 30 minute period and then sum bytes for the streaming category for the same period, then display a line chart showing the comparison for the bandwidth used for the streaming category to the bandwidth used by all categories combined by minute. ... View more

I've uploaded a KMZ file as a lookup file and created the lookup definition; however, when I try to test it, the search says it's finalizing but never completes and does no display a map. I'm not sure I got the xpath formatted correctly. Below is a sample from the KML file and the XPATH I used. Any Ideas? The featureIdField that I want is at the end of the sample and is: <value>A - Regional Choice</value> XPATH: /kml[@xmlns:kml="http://earth.google.com/kml/2.2"]/Document[@id="featureCollection"]/Folder/Placemark/ExtendedData/Data[25]/value/text() Sample from KML File: <?xml version='1.0' encoding='UTF-8'?> <kml xmlns:kml="http://earth.google.com/kml/2.2"> <Document id="featureCollection"> <Style id="defaultStyle"> <LineStyle> <width>1.5</width> </LineStyle> <PolyStyle> <color>7d8a30c4</color> </PolyStyle> </Style> <Folder><Placemark> <styleUrl>#defaultStyle</styleUrl> <ExtendedData> <Data name="cfc1214_ci"><value>11.0</value></Data><Data name="phoo_hu_14"><value>0.72989377845</value></Data><Data name="pcin_14_ci"><value>0.0772164978</value></Data><Data name="chuo_14_ci"><value>659.0</value></Data><Data name="cvac_14_ci"><value>3.0</value></Data><Data name="msp1214_ci"><value>242500.0</value></Data><Data name="husqmi14ci"><value>15330.298244</value></Data><Data name="churo_14_c"><value>178.0</value></Data><Data name="clusterlet"><value>A</value></Data><Data name="cvalt14_ci"><value>3.0</value></Data><Data name="geoid10"><value>245100101001</value></Data><Data name="landsqmile"><value>0.043052</value></Data><Data name="csp1214_ci"><value>130.0</value></Data><Data name="shape_area"><value>0.0000116407</value></Data><Data name="sp_estimat"><value>0.0</value></Data><Data name="shape_leng"><value>0.01550170555</value></Data><Data name="cpa1214_gt"><value>58.0</value></Data><Data name="pvlot14_ci"><value>0.00470219436</value></Data><Data name="pvac_14_ci"><value>0.00472440945</value></Data><Data name="chuoo_14_c"><value>481.0</value></Data><Data name="vsp1214_ci"><value>0.38502451782</value></Data><Data name="pfchu1214"><value>0.01732283465</value></Data><Data name="ppa1214_gt"><value>0.09133858268</value></Data><Data name="chu_14_ci"><value>660.0</value></Data><Data name="hmt"><value>A - Regional Choice</value></Data> </ExtendedData> ... View more

I'm trying to create column with a link to WHOIS for the results of a search but I'm running into an error indicating that the "field" attribute is deprecated, any ideas on how to correct this? A quick search didn't reveal a working solution. Warning on line 9: Attribute "field" is deprecated <dashboard> <label>*** Test WHOIS ***</label> <row> <panel> <table> <search ref="DMZ Inbound Traffic Greater Than 2 Std Deviations Over Mean"> </search> <drilldown target="_blank"> <link field="WHOIS"> <![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]> </link> </drilldown> <option name="rowNumbers">false</option> <option name="drilldown">cell</option> <option name="count">30</option> </table> </panel> </row> </dashboard> ... View more

I have a need to track VPN access outside the country. I have an alert that triggers when someone accesses the VPN from outside the country but I would like to make another search to track the amount of time they have been outside the country based on the event time stamp. Current search to alert on OCONUS VPN use: <My search> | iplocation vpn_remote_ip | search Country!="United States" | dedup vpn_user,Country | table _time,vpn_user,Country,vpn_remote_ip I would like to modify the above search to create a report that would show something like below: User OCONUS time User1 15 days User2 9 days ... View more