Hi Splunk Answers, I want to exclude IP addresses from certain networks in search results. The range is 10.52.0.0/24 - 10.52.40.0/24. If I want to exclude using one range I would use | where NOT cidrmatch("10.52.0.0/24") How would I exclude multiple ranges? ... View more

Ive been spending a long time trying to get 1 correlation search working. The search is to find non standard hostnames that have been assigned a dhcp address, this would cover a scenario where a rogue laptop is plugged into the network. The search I am using is: description=assign | search dest!=Prefix1* | search dest!=Prefix2* | search dest!=Prefix3* | search dest!=Prefix4* | dest_ip!=10.50.x.1/20 dest_ip!=10.51.x.1/21 dest_ip!=10.49.x.1/27 | rex mode=sed field=dest "s/.company.domain.com//g" | where dest!=dest_mac Prefix1*, Prefix2* etc are known hostnames that follow a naming convention. Some VOIP phone devices that use dhcp have a hostname that is the same as their mac address which is why there is 'where dest!=dest_mac In the notable search itself I have: Notable event title: Suspicious Host Discovered - $dest$ at $time$ on $date$ Notable event description: The system $dest$ has been assigned an IP Address Start time is: -3d (so I get some initial result, this will change to -5 when proven working) End time is: now cron: set to run every 5 mins The goal is to search the last 5 mins of dhcp logs every 5 mins using the search above so that an unknown host that uses dhcp can quickly be discovered. However in the Incident Review dashboard the title is displayed as: Suspicious Host Discovered - unknown at unknown on unknown It doesnt appear to read the field results correctly. I've run this search manually in a standard search and I have 3-4 results when searching over the last 3 days. Also, what happens if the correlation search finds multiple hostnames that fit the criterea of the search, does it create seperate notable events? Thanks ... View more

Hi Splunk Answers, I understand that notable events can be assigned severity as well as being assigned to different analysts. Is it possible to update an event with comments. This would be useful so the analyst working on the event can enter useful information before assigning to another analyst. Thanks ... View more

Hi Splunk Answers, How would I know what 'Application Context' to choose when creating a new correlation search? The only info I have found is that it's for "context for the search (for example, Access Protection) ". Do I need to map the search datamodel to one of the security domains? If I don't choose the right context, does that affect the search results? Thanks ... View more

Hi guys Im doing a correlation search where Im looking for hostnames and filtering for events I dont want. eg. sourcetype=dhcplogs where dest!=Prefix1* OR dest!=Prefix2* OR dest!=Prefix3* OR dest!=Prefix4* ..... Is there a more efficient way of grouping multiple OR operators together? Would this help with search processing, or just tidier to read. Cheers ... View more