About paulw10

paulw10 · ‎11-16-2020

it's ok I managed to find the problem. i Was not digging far enough into the RAW events and in actual fact the events mentioned Account_name twice with the second value showing as - so Splunk naturally recorded two account names for the events.

paulw10 · ‎11-16-2020

I am trying to create an alert to track failed login events on windows machines e.g. index=fa_servers EventCode=4625 OR 533 OR 529 but I have a problem where the account name in the event has a hyphen. Splunk is treating the hyphen as another account name Values Count % - 87 100% OMGHCLPP-ADS002$ 46 52.874% ALPHCLPP-ADS002$ 41 47.126% you can see the 87 count is 46+41 so its treating the hyphen as its own value. I have been trying to use eval and mvindex to try and just extract the 2 usernames but i am not getting anywhere. can someone explain how i can properly parse these values so it only sees 2 account names

paulw10 · ‎08-25-2020

thanks all, i was being a dumb-dumb and had the wrong case on message, it needed to be Message. this code works great and gives me what I need. thank you

paulw10 · ‎08-25-2020

Apologies but that's not working for me either. there are 5 service names i need to track under this alert McAfee Validation Trust Protection Service McAfee Task Manager McAfee McShield TrueSight Server Automation RSCD Agent Tanium Client There is a Dot. at the end of the message thanks for your help so far. Regex really is not my forte

paulw10 · ‎08-24-2020

that regex is almost what i need but it wont match services with more than 1 word in the name. how can i do that. ?

paulw10 · ‎08-24-2020

yeah I need help extracting the service and status to fields. have been trying to do this with eval but not getting anywhere so the eventlog has a message like Message=The 'Sample Service' service entered the stopped state, or running state so i want to extract both the service name and stopped/running values into a variable then perform a comparison, so for a given host check if there is an event with stopped state but no event with running state.

paulw10 · ‎08-24-2020

Hi, I am trying to find the best way to query events based on windows event log 7036 , around status of a service. I want to search for events that contain the words 'stopped' and 'running' and then run a comparison that will trigger an alert if there is an event with "stopped" message but NO message containing running. I am trying to create a alert that triggers if a service falls over, but also account for scheduled and approved restarts of the server/service. so the search runs for the last 15 mins and if there is an event mentioning stopped, but not one mentioning running for the same service, i want the alert to trigger. is this possible.

paulw10 · ‎03-26-2020

Hi, I need help with this problem again. So as previously stated i only want to remove the zero's in the middle , but the options given above seem to remove all 0's. so lets say my external ID is 867182000000921046 i want my table to show 867182921046 but the above options are removing all 0's and giving me 86718292146 any ideas how i can do this.

paulw10 · ‎03-26-2020

Hi, I need help with this problem again. So as previously stated i only want to remove the zero's in the middle , but the options given above seem to remove all 0's. so lets say my external ID is 867182000000921046 i want my table to show 867182921046 but the above options are removing all 0's and giving me 86718292146 any ideas how i can do this.

paulw10 · ‎02-26-2020

Excellent. thank you both

paulw10 · ‎02-26-2020

Hey, I have a field called externalID with values like the following 1766000000009834 1766000000009835 1766000000009836 and i am looking for a way to remove all the 0's in the middle when i output to a table and then rename the field to something like shortID , so the table output would show the following values 17669834 17669835 17669836 I have tried playing around with functions like eval, ltrim, replace...etc and not getting anywhere. can anyone help me out. UPDATE: Hi, I need help with this problem again. So as previously stated i only want to remove the zero's in the middle , but the options given above seem to remove all 0's. so lets say my external ID is 867182000000921046 i want my table to show 867182921046 but the above options are removing all 0's and giving me 86718292146 any ideas how i can do this.

Posts	11
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎02-26-2020

Online Status	Offline
Date Last Visited	‎11-16-2020 02:22 PM

problem with hyphen in field values

Comparing contents of separate but related events

Remove irrelevant 0's from a field value

Re: problem with hyphen in field values

problem with hyphen in field values

Re: Comparing contents of separate but related eve...

Re: Comparing contents of separate but related eve...

Re: Comparing contents of separate but related eve...

Re: Comparing contents of separate but related eve...

Comparing contents of separate but related events

Re: Remove irrelevant 0's from a field value

Re: Remove irrelevant 0's from a field value

Re: Remove irrelevant 0's from a field value

Remove irrelevant 0's from a field value

Are you a member of the Splunk Community?