Hello, In order to clean our filtering rules we'd like to check if some of our old URL's are still in use (an if yes - how many times in last 90 days). Basically we'd like to perform the query below: index=nginx sourcetype="nginx:plus:access" | search uri_path=<uri_path_we_are_searching_for> | stats count The problem is that there are almost 600 URL's we need to check. We'd like to know if there is a way to put all the URL's in a lookup and then perform a kind of foreach search. Thanks for the help. Alex. ... View more

Hello, I'd like a report to be sent every first Tuesday of the month at 11:00 pm. Thinking logically, I should use this cron: 0 23 1-7 * 2 . But for some reason, I receive the report every day during the first week of the month. Do you have an idea what am I doing wrong? Thanks for the help. Alex. ... View more

Hello, We trying to export Jamf Pro logs to Splunk. Splunk is not officially supported by Jamf, but there’s a Splunk app on GitHub which integrates search APIs in Jamf Pro with Splunk’s modular input. Technically it looks easy, just a repository to clone and configuration to write in default/inputs.conf file. But we weren’t able to find which values we should write for ‘api_call’ and ‘search_name’ parameters. Do you have any ideas? Or do you know a better way to import Jamf Pro logs to Splunk? Thanks for the help. Regards, Alex. ... View more

Hello, I'm trying to create a list of users who use a particular software, lest say Notepad 7.6.3. I can easily find the PCs where software is installed: index=my_software_list software_name=“Notepad 7.6.3” | table dns_name Now I’m thinking to simply use Windows Security logs and find user who was connected to these PCs. Something like: index=windows_security EventCode=4624 dns_name=??? | table user The question is how can I put all PCs found in my previous search to this query? Should I use join left ? Should I export the results of the first search to a lookup and then perform inputllokup in a separate one? Any other idea? Thanks for the help. Regards, Alex. ... View more

Hello, We use an ES ‘Excessive Failed Logins’ correlation search: | tstats summariesonly=true allow_old_summaries=true values(Authentication.tag) as "tag",dc(Authentication.user) as "user_count",dc(Authentication.dest) as "dest_count",count from datamodel=Authentication.Authentication where nodename=Authentication.Failed_Authentication by "Authentication.app","Authentication.src" | rename "Authentication.app" as "app","Authentication.src" as "src" | where 'count'>=6 But we would like to add an additional condition to the search, where ‘signature_id’ field in Failed Authentication data model is not equal to 4771. At the end of the search, we tried to add something like |where signature_id!=4771 or |search NOT signature_id =4771 , but of course, it didn’t work because count action happens before it. Do you have an idea how we can implement that condition? Thank for the help. Alex. ... View more

Hello, In order to detect unused workstations in our computer park, we are searching for all assets not connected to Active Directory (AD) AND to Ghost Solution Suite (GSS) since >90 days. We can easily perform two searches independently, which are basically the same. First one: sourcetype=my_ad_sourcetype | eval it = strptime(ad_last_inventory,"%Y-%m-%d") | eval ot = strptime(nowstring,"%Y-%m-%d") | eval diff = (ot - it) | eval round = round(diff/86400, 0) | search round > 90 | table ad_wks_name, ad_last_inventory And the second one: sourcetype=my_gss_sourcetype | eval it = strptime(gss_last_inventory,"%Y-%m-%d") | eval ot = strptime(nowstring,"%Y-%m-%d") | eval diff = (ot - it) | eval round = round(diff/86400, 0) | search round > 90 | table gss_wks_name, gss_last_inventory What we can’t do is to combine those two searches. We tried to execute one of two queries as a subsearch and perform a simple comparison at the end like: | where gss_wks_name=ad_wks_name Every time we face an issue, the main search is executed correctly, but the subsearch doesn’t give out the correct result. Instead it repeats the _wks_name and the _last_inventory date for the last workstation. wks_123 | 2018-10-20 23:12:00.0 wks_123 | 2018-10-20 23:12:00.0 wks_123 | 2018-10-20 23:12:00.0 etc. Do you have an idea what we're doing wrong? Thanks for the help! Alex. ... View more