Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Dalador
Dalador
Path Finder
Member since:
03-31-2021
05-17-2021
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 11 |
| Karma Received | 1 |
| Member Since | 03-31-2021 |
Activity Feed
- Posted Re: Combine ldapsearch with simple search on All Apps and Add-ons. 05-13-2021 06:32 AM
- Karma Re: Combine ldapsearch with simple search for richgalloway. 05-13-2021 04:23 AM
- Karma Re: Combine ldapsearch with simple search for richgalloway. 05-13-2021 04:23 AM
- Karma Re: Combine ldapsearch with simple search for richgalloway. 05-13-2021 04:22 AM
- Posted Re: Combine ldapsearch with simple search on All Apps and Add-ons. 05-13-2021 01:14 AM
- Posted Re: Combine ldapsearch with simple search on All Apps and Add-ons. 05-12-2021 07:01 AM
- Posted Re: Combine ldapsearch with simple search on All Apps and Add-ons. 05-12-2021 06:22 AM
- Posted Combine ldapsearch with simple search on All Apps and Add-ons. 05-12-2021 05:23 AM
- Got Karma for Re: Exclude results from lookup table in search. 04-09-2021 06:05 AM
- Posted Re: Exclude results from lookup table in search on Splunk Search. 04-09-2021 05:59 AM
- Posted Re: Exclude results from lookup table in search on Splunk Search. 04-09-2021 05:23 AM
- Posted Exclude results from lookup table in search on Splunk Search. 04-09-2021 03:00 AM
- Posted Re: How to return all results if field is not exist? on Splunk Search. 04-09-2021 01:16 AM
- Karma Re: How to return all results if field is not exist? for gcusello. 04-09-2021 01:15 AM
- Posted How to return all results if field is not exist? on Splunk Search. 04-09-2021 01:00 AM
- Karma Re: How to separate field for ITWhisperer. 03-31-2021 05:33 AM
- Karma Re: How to separate field for ITWhisperer. 03-31-2021 05:33 AM
- Karma Re: How to separate field for ITWhisperer. 03-31-2021 05:33 AM
- Karma Re: How to separate field for ITWhisperer. 03-31-2021 05:33 AM
- Posted Re: How to separate field on Splunk Search. 03-31-2021 05:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-13-2021
06:32 AM
I decided to rewrite my query now i'm doing: | ldapsearch domain=my_domain search="(&(objectClass=user)(!(objectClass=computer)))" attrs="objectSid,sAMAccountName" | outputlookup Ldap.csv and then do my main search Do you now how can I run this by a cron?Shoud i use alert function to schedule this search?
... View more
05-13-2021
01:14 AM
I don't know why but query index=windows_audit EventCode=4732 | eval added_by=mvindex(Security_ID,0) | eval Sid=mvindex(Security_ID,1) | return $Sid return only 1 result, and then i use your original answer i got Unrecognized ldapsearch command option: Sid="\"S-1-5-21-1778430667-2033019328-1848965733-3395\"" Is there possible to use |ldapsearch domain="my_domain" search="(&(objectSid="[|search index=windows_audit EventCode=4732 | eval added_by=mvindex(Security_ID,0) | eval Sid=mvindex(Security_ID,1) | return Sid]"))" attrs=cn |table cn, Sid For several results in sub-search? Thank you!
... View more
05-12-2021
07:01 AM
Thanks! I think soon I get the solution. Now I need to get rid off Sid="...", right?
... View more
05-12-2021
06:22 AM
This returns External search command 'ldapsearch' returned error code 1. Script output = "error_message=malformed filter
... View more
05-12-2021
05:23 AM
Hi! I'm trying to combine ldapsearch with a simple search Here is my query: |ldapsearch domain="domain_name" search="(objectSid=$added_by$)" attrs=cn |table added_by [|search index=windows_audit EventCode=4732 | eval added_by=mvindex(Security_ID,0) | eval Sid=mvindex(Security_ID,1)] The idea is to find CN by Sid using ldapsearch function. But I got an error Error in 'table' command: Invalid argument: 'Account_Domain=domain_name' Query like: |ldapsearch domain="domain_name" search="(objectSid="some_sid")" attrs=cn |table cn Is working perfect on my splunk. What am I doing wrong?
... View more
Labels
- Labels:
-
other
-
search
-
troubleshooting
04-09-2021
05:59 AM
1 Karma
I rewrote my query: EventCode=4698 | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |search NOT [|inputlookup scheduled_task |fields Arguments, Command]|table Task_Name, ComputerName,Command,_time,Arguments, Account_Name This works for me 🙂
... View more
04-09-2021
03:00 AM
I have a lookup table with Scheduled Tasks called scheduled_tasks, and Columns Command, Arguments. I need to do a search where I only display results where the Arguments, Command fields in events DOES NOT contain a value in the scheduled_tasks lookup table. Where it is going wrong? Thank you! My query is: (index IN (index1, index2)) EventCode=4698 NOT [|inputlookup scheduled_tasks |fields Arguments, Command] | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Command,Arguments |dedup Command,Arguments My lookup table:
... View more
04-09-2021
01:16 AM
This works for me, Thanks!
... View more
04-09-2021
01:00 AM
Hi, i use regex to extract fields My query is | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Task_Name, ComputerName,Command,_time,Arguments |dedup Task_Name, ComputerName,Command,_time,Arguments How can i return results if Arguments field is not exist? For example: ...some xml log.... <Command>C:\Windows\System32\wevtutil.exe</Command> <Arguments>sl Microsoft-Windows-PrintService/Operational /e:true</Arguments> ...some xml log.... Is Ok And ...some xml log.... <Command>C:\Windows\System32\wevtutil.exe</Command> ...some xml log.... Is not OK.
... View more
Labels
- Labels:
-
field extraction
-
fields
-
other
-
regex
03-31-2021
05:30 AM
yes, exactly what i need! Thanks, didn't know that we can use rex like this..
... View more
03-31-2021
02:23 AM
Yep, this almost looks like i want! Thanks! But, how to unite this two search? I tried to |eval _raw="ip0" and get no results
... View more
03-31-2021
01:24 AM
ip0 is a multi-value field, Sorry, i'm new to splunk and i try to do my best i tried to add your solution to my search string and get empty results 😞 I want just this 4 ip adresses in separate columns, and add _time, i think
... View more
03-31-2021
12:54 AM
Thanks, Unfortunately this is not working for me 😞 I want something like this:
... View more
03-31-2021
12:24 AM
Hi, guys. I have a big trouble here. I'm using rex to get ip-adresses. |rex max_match=0 "(?P<ip0>((?:[0-9]{1,3}\.){3}[0-9]{1,3}.[0-9]{1,9}))" field1: 255.255.255.255/1 255.255.255.255/2 255.255.255.255/3 255.255.255.255/4 How can i do this? Please, help 😞 I want to get something like this field1: field2: field3: field4: 255.255.255.255/1 255.255.255.255/2 255.255.255.255/3 255.255.255.255/4
... View more
Labels
- Labels:
-
field extraction
-
fields
-
regex
-
rex
-
table
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-17-2021
04:04 AM
|
Karma given to
