cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
DW2054
Engager
Member since: ‎09-19-2014
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎09-19-2014
Activity Feed
View All

Re: How to create a sudo to root, dedup 24 hours r...

by in Splunk Search
‎12-15-2014 01:37 PM
‎12-15-2014 01:37 PM
Final version: COMMAND=/bin/su - process=sudo| rex "(?i) sudo: (?P[^ ]+)"| table date_month, date_mday, host, path_name |dedup host path_name| sort date_mday, host, path_name| search path_name>0| rename "date_month" as "Month" "date_mday" as "Day" "host" as "Server" "path_name" as "User ID" Works perfect! Thank you! ... View more

How to create a sudo to root, dedup 24 hours repor...

by in Splunk Search
‎12-15-2014 09:50 AM
‎12-15-2014 09:50 AM
How to create a sudo to root, dedup 24 hour by user report? So far I have: process=sudo "USER=root"| rex "(?i) PWD=(?P[^ ]+)"| table date_month, date_mday, host, path_name | dedup host|sort date_mday, host, path_name|rename "date_month" as "Month" "date_mday" as "Day" "host" as "Server" "path_name" as "User ID" I am getting about 90% of what I want...But the dedup host is causing me to miss data related to multiple users sudo'ing into the same server on the same day. If I take dedup host out, I get numerous transactions of the SUDO user on the same machine. ... View more

Re: How to search web traffic from a particular ip...

by in Getting Data In
‎09-19-2014 03:37 PM
‎09-19-2014 03:37 PM
Ryan, Thank you for the answer, I really appreciate it. This is what I used: (time 24 hours) (IP Adress) www.*| bucket span=15m _time | stats list(catdesc) AS Description, list(count) as count by hostname | sort -Count I get: Hostname Description Count Google Search Engines and Portals was blank. Do you know how to covert the descriptions to counts and only show: Google Search Engines and Portals 37. Does the bucket span 15 take the length (24 hours) and break it down into 15 minute increments? Thank you ... View more

How to search web traffic from a particular ip add...

by in Getting Data In
‎09-19-2014 09:15 AM
‎09-19-2014 09:15 AM
What I am trying to get: A 14 days chart of category descriptions that has a meaningful count. Right now I see things like: Type____________________________________________________________Count Search Engines and Portal 7000 What I would like it be" Type_______________________________________________________________Count Search Engines and Portal 344 On the back end a person went to google and did multiple searches for ~ 15 minutes a day over 14 days. Detailed thoughts: Look at a ip address's website traffic over 14 days, distinguish visit to a site vice numerous log entries due to initial visit to a site (walmart.com pulls something like 6-9 different events). Transform that into catdesc to show # of visits to a particular type over 14 days. What I had originally tried was: (IP address) www.*| chart count by catdesc limit=0 | sort -count Thank you! ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma given to
View All