About gerrydevenney

gerrydevenney · ‎11-24-2017

P.S So that I will end up with a list of events that do not where User, Hostname and Eventtype do not correspond to any rows in the csv.

gerrydevenney · ‎11-24-2017

I probably didn't make myself clear enough. Here is an example. I have a windows event from the security log (for example). In the event is (for example) the user field, the hostname field and the eventtype field i.e Tom S1234 and 4625 (for example). Now if there is a row anywhere in my csv that reads Tom,S1234,4625 then I want to ignore this event. Does that make it clearer?

gerrydevenney · ‎11-23-2017

I want to create a search that will use a csv to ignore results if the result of the search has fields equal to a row in the csv i.e. suppose I have a csv that has two columns e.g. Col1 and Col2 with values of x and y etc. I want the search to equate field A in the search with x in the csv and also equate field B with y in the csv. If both are equal I do not use this in a report, dashboard etc. I've tried various combinations of where and inputlookup but it is eluding me. The reason for a csv is because I need to allow users to update this file as and when new info turns up. My apologies if I have not been clear, any help would be greatly appreciated

gerrydevenney · ‎10-30-2017

I am reminded of the quote by the Denzel Washington character in the film Philadelphia, "Now, explain it to me like I'm a four-year-old.". But I like your style. It is uncanny how you know my 'wife' Thanks for the clarification. I was hoping it was going to be as simple as this.

gerrydevenney · ‎10-30-2017

I have a 50GB Splunk licence and equivalent 50GB ES licence. I have been asked to install a 25GB ES licence in preparation for new projects that will be using Splunk over the course the following year. The projects will buy their own Splunk licence but the owner of Splunk wants to make sure that the ES licence is installed before this since the owner of the environment is responsible for ES and the projects are not. Firstly how would I upgrade the existing ES licence and secondly is this a proper way to add the ES licence

Posts	5
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎10-30-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Need to compare fields in a csv

How do I add to Splunk Enterprise Security license...

Re: Need to compare fields in a csv

Re: Need to compare fields in a csv

Need to compare fields in a csv

Re: How do I add to Splunk Enterprise Security lic...

How do I add to Splunk Enterprise Security license...