Hello All, Having some trouble coming up with a way to extract a file with three random characters and a .jnlp extension from the URI. Here is what I've attempted to so far. Any assistance would be greatly appreciated. index=wsa .jnlp | rex field=csurl (?) | regex csurl="\/[a-z0-9]{3}.jnlp$" ... View more

Is there a way to eliminate duplicates by reports? Specifically what I'm looking to do is run a report every 24hrs for X range | stat count by shost. I don't want the report to show any hosts that showed up on the previous report. I know how to eliminate duplicates from a single report but don't know if it's possible to "dedup" on a previously run report. Thanks ... View more

Sorry in advance to the newbie question but, is there a way to import a list of IP addresses into splunk search query? For example, I come across a couple of pieces of malware and identify the call back addresses which could number into the dozens or even hundreds. I would like to be able to import a list with these addresses into Splunk and run those across my Web Logs looking for any activity. Thanks ... View more

I'm looking at creating a report that extracts suspicious TLDS over a period of time such as, as past six hours, or past twelve hours etc. Some of the TLD that I want to look at would be .ru, .ua or double like .rr.nu or cz.cc. I'm looking for a good way to extract the TLD from the URL and display that in a chart. I've seen a few regex's floating around but haven't had much luck modifying them into what I want to do. Thanks in advance ... View more