About hmrabet2

hmrabet2 · ‎05-04-2021

Anonymised raw sample: {"hostname":"ip-xxx-xxx-xxx-xx.eu-west-1.compute.internal","query":"xxxxx.net.","response_code":"NXDOMAIN","size":"89","src_ip":"xx.xxx.xxx.xxx","timestamp":"1617865214"}

hmrabet2 · ‎04-30-2021

Thanks, i have added the below to the advanced section under timestamp but its still defaulting back to modtime.

hmrabet2 · ‎04-30-2021

Example timestamp in raw logs: timestamp: 1617865161

hmrabet2 · ‎04-29-2021

Im onboarding sample logs from a txt file to my local Splunk instance were the time stamp is in a 10 digit format (epoch time format). During the onboarding im applying the following timestamp format strptime("timestamp","%m/%d/%y %H:%M:%S") "timestamp" being the field name in the raw sample in the txt document. But the timestamp is still defaulting to modtime. Any ideas?

hmrabet2 · ‎05-18-2018

Thanks, I'm getting results against the "Sanitised" field in the lookup table but for some reason the query does not want to output the second field from the lookup. Any ideas? data is present in the lookup table for the second field . When the search completes just the second filed column is empty.

hmrabet2 · ‎05-03-2018

The mvappned doesnt want to extract the 2nd field from the lookup. eval query=mvappend(Sanitised, someOtherFieldHere)

hmrabet2 · ‎04-30-2018

Thanks, The mvappned doesnt want to extract the 2nd field from the lookup 😞 eval query=mvappend(Sanitised, someOtherFieldHere)

hmrabet2 · ‎04-30-2018

This is working for me at the minute but the search is unable to output a second field from the same "threatlist.csv" lookup file. The lookup table contains two fields "Sanitised" which is the bad IP in a sanitised format and "Threattype" which holds the treat name. Index= * | search [| inputlookup threatlist.csv | eval Sanitised=replace(Sanitised, "[.]", ".") | table Sanitised | rename Sanitised as query | format] | table _time, Threattype, Sanitised ......................

hmrabet2 · ‎04-30-2018

Hi, Im trying to output another column from a lookup table i have created named "threatlist.csv". The problem im having is outputting the second field named "Threattype". | search [| inputlookup threatlist.csv | eval Sanitised=replace(Sanitised, "[.]", ".") | table Sanitised | lookup threatlist.csv Sanitised as url OUTPUT "Threattype" | rename Sanitised as query] |

hmrabet2 · ‎12-21-2017

Is there a way up populate contents of a lookupfile such such as srcip and destip obtained from another source currently not feeding in to splunk? im wanting to do this from the splunk search box or dashboard input box?

hmrabet2 · ‎09-29-2017

Thanks that's done the trick

hmrabet2 · ‎09-29-2017

I am not getting iplocation working in this query: tag= web | stats count by IP, sessionId | stats dc(IP) as count, values(IP) as clientIP by sessionId | where count> 5 | iplocation clientIP I can see the country, city, region fields appear but they are not populated But when I run the following search I get IP location working with the country, region etc fields populated. tag= web | iplocation IP | table IP, Country

hmrabet2 · ‎05-23-2017

If a match was found based on the "IP_Blacklist" field how would I output another field named "comments" field from the same lookup file as a OUTPUT. I have tried adding the following to the end of the search: | lookup Blacklist.csv IP_Blacklist OUTPUT comments | table IP_Blacklist, comments It matches the number of triggered events but the table of results are empty.

hmrabet2 · ‎05-16-2017

The data models don't contain a field named "IP_Blacklist". What I am trying to accomplish is to reference the "IP_Blacklist" field from my lookup file in the search and match this against any IP addresses in the Splunk platform to give me a list of bad IP's.

Posts	14
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-16-2017

Online Status	Offline
Date Last Visited	‎05-05-2021 07:33 PM

Epoch Time

Output lookup

updating lookup file

Can't get iplocation to work in my search

Re: Epoch Time

Re: Epoch Time

Re: Epoch Time

Epoch Time

Re: Output lookup

Re: Output lookup

Re: Output lookup

Re: Output lookup

Output lookup

updating lookup file

Re: Can't get iplocation to work in my search

Can't get iplocation to work in my search

Re: How to edit my data model search to reference ...

Re: How to edit my data model search to reference ...

Join the Conversation