About meadowh

meadowh · ‎09-08-2015

Would be good to know the current status of protecting log fidelity in Splunk: Does Event Hashing still work in Splunk 6.2?? What about - IT data block signing Audit signing?

meadowh · ‎06-26-2015

Great thanks guys. i had a few errors in my lookup table that caused some weird results. All good now. I have used this before as my guide: search | lookup [lookup definition name] [fieldname1 in lookup table to check] as [fieldname2 in events] OUTPUT [ fieldname3 in lookuptable ] as [fieldname4 - you can create a new name] | search [fieldname4]=”*” couldn't understand why it wasn't working this time!

meadowh · ‎06-25-2015

I have a lookup table called - c2cisp.csv. the definition is called c2cisp. The table has a field name ip. It contains IP addresses. I want to search through my firewall logs to check to see any events where the ip in my events field 'd_ip' matches any of the ips in the 'ip' field in my lookup table. Seems like it should be pretty easy right? Any help much appreciated

Posts	3
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎02-04-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to search a lookup table to find any IP addres...

Re: How is the removal of IT data block signing, A...

Re: How to search a lookup table to find any IP ad...

How to search a lookup table to find any IP addres...