Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About keyu921
keyu921
Explorer
Member since:
05-11-2020
05-10-2021
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 05-11-2020 |
Activity Feed
- Posted Splunk searching Syntax on Splunk Search. 05-10-2021 01:05 AM
- Posted Filter away pattern on windows event log report on Splunk Search. 09-19-2020 03:23 AM
- Karma Re: CSV Lookup for search query for gcusello. 09-19-2020 03:23 AM
- Posted CSV Lookup for search query on Splunk Search. 08-27-2020 07:38 PM
- Posted Field extract on Splunk Search. 06-18-2020 08:31 PM
- Posted Splunk logging issues on Splunk Enterprise. 06-14-2020 07:07 PM
- Posted Re: Accum statement on Splunk Search. 05-27-2020 10:58 PM
- Posted Accum statement on Splunk Search. 05-27-2020 07:42 PM
- Tagged Accum statement on Splunk Search. 05-27-2020 07:42 PM
- Posted Re: count problem on Splunk Search. 05-26-2020 06:09 PM
- Posted Re: count problem on Splunk Search. 05-26-2020 02:20 AM
- Posted count problem on Splunk Search. 05-25-2020 10:30 PM
- Tagged count problem on Splunk Search. 05-25-2020 10:30 PM
- Posted Re: inputlookup csv on Splunk Search. 05-25-2020 07:52 PM
- Posted Re: inputlookup csv on Splunk Search. 05-25-2020 01:57 AM
- Posted inputlookup csv on Splunk Search. 05-25-2020 01:50 AM
- Tagged inputlookup csv on Splunk Search. 05-25-2020 01:50 AM
- Posted Re: eval or rex help on Splunk Search. 05-21-2020 01:21 AM
- Posted Re: eval or rex help on Splunk Search. 05-21-2020 01:07 AM
- Posted Re: eval or rex help on Splunk Search. 05-20-2020 11:54 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-19-2020
03:23 AM
Current report for the following event log index=windows EventType=4 host=* | table _time host EventCode Message /// EventType=4 Type=Information ComputerName=NOYO.asus.com Message=Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.323.1450.0) // I try to filter away if event if message contains Security Intelligence Update for Microsoft Defender Antivirus index=windows EventType=4 host=* | where Message="%Security Intelligence Update for Microsoft Defender Antivirus%" | table _time host EventCode Message But seems message cannot filter
... View more
Labels
- Labels:
-
table
08-27-2020
07:38 PM
I prepared csv to inputlookup to compare the Splunk logs. adhoc.csv // Account, test01,etc.... test02,etc.... // my Query index=msad sourcetype=msad [| inputlookup adhoc.csv | fields Account] Searching Period: Last 24 hours Cross check adhoc.csv match the searching logs. For those account did not perform any authentation which logs stored at index=msad, during search period, then show zero values.
... View more
06-18-2020
08:31 PM
I want to extract the client ip and user "DELTA\Kelly" from the windows event messages Message=The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a cleartext (non-SSL/TLS-encrypted) LDAP connection. Client IP address: 172.4.5.6:57157 Identity the client attempted to authenticate as: DELTA\Kelly Binding Type: Fixed..... Please close
... View more
05-27-2020
10:58 PM
bar chart that no.active and trend grow for last1yrs timechart span=1month
... View more
05-27-2020
07:42 PM
My data as following
Location|No.of active
US|200
UK|20
SZ|30
How to accum all those location by month by area chart
I now search as
w search as
|timechart span=1mon count by location| accum us as us| accum uk as uk | accum sz as sz | fields - uk us sz | fillnull
... View more
- Tags:
- splunk-enterprise
05-26-2020
02:20 AM
After I review the data, I got 30 license type, I want to keep 365E1 and 365E2 for adopted and others are non-adopted
How can I eval like?
| eval kind=if(license!="%OFFICE 365%","non adopted","adopted")
| chart dc("email") OVER kind BY country
... View more
05-25-2020
10:30 PM
I have following data email|country|license aa|HK|365E1 bb|US|365E2 cc|HK|non-office dd|HK|non-office ee|UK|non-office
I would like to got bar chart that values of adopted (365E1+365E2) and non-adopted and count by country
base_search | chart dc("email") AS Count over country by license
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
chart
05-25-2020
01:57 AM
index=* sourcetype=csv |search [|inputlookup testing| return 1000 $host]
| stats last(Size) last(Used) last(Use) by host
... View more
05-25-2020
01:50 AM
I setup testing.csv lookup as following host,location 123,HK 234,US 345,UK
I would like to basic search if host matched in the log, stats count by location index=log sourcetype=csv |search [|inputlookup testing | return $host] | stats .... by location
But seems return nothings
... View more
- Tags:
- splunk-enterprise
05-20-2020
07:39 PM
Message="Internal event: Function ldap_search entered. SID: S-1-5-18 Source IP: 127.0.0.1:25855 Operation identifier: 680571 Data1: Data2: 2796807187 Data3: Data4:"
How can I just left message "Message="Internal event: Function ldap_search entered."
by rex to define as fields or use eval command?
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
rex
05-19-2020
08:40 PM
I search the syntax and find Account_Domain result contains two column. How can I result first column so that I left ALPHA??
ALPHA
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
eval
05-14-2020
08:31 PM
My Data as following AA || Disabled || Region 11@abc.com || Yes || HK 12@abc.com || No || US 13@abc.com || No || US 14@abc.com || No || UK 15@abc.com || Yes || UK 16@abc.com || No || UK 17@abc.com || No || UK 18@abc.com || No || HK 19@abc.com || Yes || HK
I would like to count as following % of account disable and enable in different region
| stats count(eval(status=="No")) as var1 by CountryRegion, count(eval(status=="Yes")) as var2 by CountryRegion ???
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
stats
