Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About anubhp
anubhp
New Member
Member since:
04-02-2020
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-02-2020 |
Activity Feed
- Posted Re: Is it possible to extract the field name itself from the logs on Splunk Search. 05-15-2020 03:32 AM
- Posted Is it possible to extract the field name itself from the logs on Splunk Search. 05-15-2020 03:04 AM
- Tagged Is it possible to extract the field name itself from the logs on Splunk Search. 05-15-2020 03:04 AM
- Tagged Is it possible to extract the field name itself from the logs on Splunk Search. 05-15-2020 03:04 AM
- Tagged Is it possible to extract the field name itself from the logs on Splunk Search. 05-15-2020 03:04 AM
- Tagged Is it possible to extract the field name itself from the logs on Splunk Search. 05-15-2020 03:04 AM
- Tagged Is it possible to extract the field name itself from the logs on Splunk Search. 05-15-2020 03:04 AM
- Posted Re: How to use tcaddindicator command in threat connect app on Splunk Enterprise Security. 05-11-2020 01:20 AM
- Posted Re: The $SPLUNK_HOME/var/spool/splunk/ directory is filling up with stash_new Files on Getting Data In. 04-27-2020 08:26 AM
- Posted Re: Splunk subsearch to find an event from a source if it is present in another source is not working on Splunk Enterprise Security. 04-05-2020 11:30 PM
- Posted Re: Splunk subsearch to find an event from a source if it is present in another source is not working on Splunk Enterprise Security. 04-02-2020 04:28 AM
- Posted Re: Splunk subsearch to find an event from a source if it is present in another source is not working on Splunk Enterprise Security. 04-02-2020 03:18 AM
- Posted Re: Splunk subsearch to find an event from a source if it is present in another source is not working on Splunk Enterprise Security. 04-02-2020 02:23 AM
- Posted Re: How can I use the results of a search in a second search? on Splunk Search. 04-02-2020 12:56 AM
- Posted Splunk subsearch to find an event from a source if it is present in another source is not working on Splunk Enterprise Security. 04-02-2020 12:47 AM
- Tagged Splunk subsearch to find an event from a source if it is present in another source is not working on Splunk Enterprise Security. 04-02-2020 12:47 AM
- Tagged Splunk subsearch to find an event from a source if it is present in another source is not working on Splunk Enterprise Security. 04-02-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
05-15-2020
03:32 AM
I am able to extract all the fields in the logs except the last one. The last attribute is a key value pair where i want the key as the field name and value as the field value as shown in the example
... View more
05-15-2020
03:04 AM
I have a data source where the log format is the same but one attribute changes for various logs. I want to extract the field name and field value from the log itself.. is it possible? Please find sample logs below
May 15 04:29:41 host datasource: "0" "Enterprise Forest" "domain" "field2" "severity" "user" "id" "profileid" "type" "eventid" whencreated=""2019-05-16T08:31:32.0000000Z""
May 15 04:29:41 host datasource: "0" "Enterprise Forest" "domain" "field2" "severity" "user" "id" "profileid" "type" "eventid" pwdlastset=""2019-05-16T08:31:32.0000000Z""
May 15 04:29:41 host datasource: "0" "Enterprise Forest" "domain" "field2" "severity" "user" "id" "profileid" "type" "eventid" badpwdcount="20"
May 15 04:29:41 host datasource: "0" "Enterprise Forest" "domain" "field2" "severity" "user" "id" "profileid" "type" "eventid" operatingsystemversion=""6.1 (7601)""
If you notice, the last attribute alone changes for each log. I want to extract the fields like mentioned below.
field value
whencreated 2019-05-16T08:31:32.0000000Z
pwdlastset 2019-05-16T08:31:32.0000000Z
badpwdcount 20
operatingsystemversion 6.1 (7601)
... View more
05-11-2020
01:20 AM
Hai, anyone got answer for this?
... View more
04-27-2020
08:26 AM
Hi, I am facing a similar issue in version 7.2.3. I don't have a monitor stanza as inputs. Any idea whats the issue
... View more
04-05-2020
11:30 PM
I have identified the issue. There was an email with Subject as "**". Because of this, it was taking all the results.
... View more
04-02-2020
04:28 AM
Yes. Both queries have field name called Subject. The query is working fine with join command.
With subsearch it was working till yesterday. suddenly it stopped working generated thousands of false alerts.
Working Join query
(sourcetype="ms:o365:reporting:messagetrace" NOT company.com Status=* ) | join type=inner [search index=notable source="Threat - Detect Spam Email - Rule" | fields Subject]
| stats dc(RecipientAddress) as recipientcount count by Subject SenderAddress
| where recipientcount > 10
i don't want to use a join command since affects search performance
... View more
04-02-2020
03:18 AM
Query1: index=notable source="Threat - Detect Spam Email - Rule"
Query1 has data of spam emails reported by users. It has events with fields "Subject"
For Eg: Subject = "Spam Email Notification"
Query2: sourcetype="ms:o365:reporting:messagetrace" NOT SenderAddress=company.com
Query2 have more details such as sender address and recipient details. I want to take the Subject from Query1 and search for events in Query2 with the same Subject and return results.
For Eg: If event with Subject "Spam Email Notification" is present is query1, i want to search for the same Subject in query2
... View more
04-02-2020
02:23 AM
Hi tried it, but not working
... View more
04-02-2020
12:56 AM
This is not working for me. It was working fine until yesterday, but suddenly stopped working Please find my query below
sourcetype="ms:o365:reporting:messagetrace" SenderAddress=@company.com Status= [search index=notable source="Threat - Detect Spam Email - Rule" | stats count by Subject | fields Subject] | stats dc(RecipientAddress) as recipientcount count by Subject SenderAddress
Any idea?
... View more
04-02-2020
12:47 AM
I have a query that looks for data from one source only if it is present in another source. It was working fine before. Suddenly it stopped working. Not sure why. Please find the query below.
sourcetype="ms:o365:reporting:messagetrace" NOT SenderAddress=company.com NOT Status= [search index=notable source="Threat - Detect Spam Email - Rule" | fields Subject] | stats dc(RecipientAddress) as recipientcount count by Subject SenderAddress
| where recipientcount > 10
The query should give results only if the event with the same Subject is available in the subsearch. However, this is giving result even though the event is not present in the subsearch.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
