I am running this in Splunk ES (Enterprise Security). My objective is to find out those savedsearch_name whose average run time is greater than 300. Need some assistance in crafting the logic. Here is my SPL so far.... index=_internal sourcetype=scheduler savedsearch_name=* `WF2020_1797_MA_active_es_shd` ACCELERATE run_time>1 | rex field=savedsearch_name "_ACCELERATE_DM_(?<savedsearch_name>.*?)_ACCELERATE_" | search savedsearch_name!="Splunk_SA_CIM_Splunk_Audit.Modular_Actions" savedsearch_name!="Splunk_SA_CIM_Splunk_Audit.View_Activity" | timechart span=5m avg(run_time) AS avg_run_time by savedsearch_name useother=f limit=0 ... View more

The correlation I am analyzing has some interesting issue. 1. When I run the SPL code separately in a search bar it has 100s of events, but when I see the Incident Review , I see only a few(very few). 2.. The last line of the correlation search  is  "outputlookup somelookup.csv".     But I see the creator of this lookup hasn't created it's definition.  could this be the reason why the notables are not getting created ????  Also when I see the stats of the correlation it it shows  Statistics Avg. Event Count 0 Avg. Result Count 0 Avg. Run Time 0:00:00 Invocations 0 Skipped 0 Success 0 Could anyone confirm if my suspicion is correct that the missing definition of the lookup is prohibiting the notables from being created with no evidence of skips, errors, or suppression in the logs. ... View more

I have a field called 'description'. I want to be able to extract MD5, SHA1, SHA256 values present in this field. Need help with regular expression. Here is an example of the field value. It's pretty huge. Towards the last you will notice MD5, SHA1, SHA256 values. Example: ============ Family: alien alien is a credential theft malware designed to run on a mobile phone running the Android operating system. This malware will attempt to monitor the users activities and steal their data by either logging keystrokes, copying their clipboard content or applying a overlay on top of legitimate applications the malware is instructed to monitor for. Pattern(s) extracted from web_inject config for this family: com.wf.Tubeswatermobile Infrastructure: hxxp://yektkedecaedem.shop Type: CNC Infrastructure purpose: A CNC is the interface between the botnet and the threat actor, allowing the threat actor to send commands, exfiltrate data and manage an infected machine.     Virustotal Report: https://www.virustotal.com/gui/url/b2eba8fb7266c50f23d71d1ref5c5df663962eccf1420d59a14ee2hb5005f6fb/detection Associated Payload Hashes: MD5 9fagf968da04a2bb464f4842ebd1bd29 SHA1 0bacdak9d1a7dbb975759d687645006f875a388b SHA256 ba57be868c89b4a342c412c066dc58ed9a888f8009ec512917004380d8e8233e http://yeytledfcaeden.shop ============ ... View more

I want to write a rex to extract values in a field that are delimited by comma. index=group sourcetype="ext:user_accounts" | rex field=Ldap_group "[,\s]+(?<Ldap_group>[^,]+)" | stats values(Ldap_group) AS Ldap_group by elid, full_name The regex I wrote only gave me few values, not all of it. I wanted all values in Ldap_group  to be written separately in different rows . Requesting assistnce Field name: Ldap_group values:   MSV_EM_IMPKliAy_Standard_App,MSV_EM_IM_Federated,MSV_AAD_WkfKBarrier_Enabled,ADTestVrpVen5_23,V-IDaaS_ServiAeNKw_VKKd_Users,DTAA_ADT_AZAD_LIA_SKU_KffiAe365_Teams,MSV_EM_IM_PKKl02_Users,DTAA_EAK_HiplWkkSuppKrt_QA SPLVRP001-16,PRV_EAK_AS_SRV_HiplWkkSuppKrt_QA,ADTestVrpVen5_23 Wave_WkterAede MyID DesktKp DSK,AppliAatiKnSuppKrtEnVWkeer,KPS-VanBeurionEESSP-KF-3,VAAT-WARP ManaVementMKdule,DTAA_JPT_ITMP_SN_SVAKPS_IP_MAJKR_WkA_MANAVER,AharlKtteDiversityTeam-3,V-KPS-TEAHNKLKVY TMS SP-AN-4,DEM_WalkMe WalkMe ExtensiKn,EES1225AIBBldV31,DTAV_EAK_EAAK(),DTAA_APD_ATK_EANF_PRKD_users,DTAA_VP_EUA_HAPA_FR_PermDisable,ENT-TeAhnKlKVy-All-4,Wave_SimKn Tatham Putty x86,ETIFTE-1,DTAA_EIT_AAV_IdaaS_JPTLearner,DTAA_AFV_ITE_TEAH_PIBI_Users,APP_HitaAhi Vantara HAP Anywhere 4.5.0.4,Tera-Partners-24,APP_KraAle Java JDK 8uXXX -X86-,MSV_EM_IM_Federated,DTAA_EIT_EAAA_EAS_IDaaS_lKVWk,SP-PermissiKns-TimSlKanKrV-32,DTAA_EIT_TRIAV_Users,DP-TeAhnKlKVyVanBeurion-4,DTAA_NSK_IAS-SNVA_Default,MSV_EM_IM_VrKupAhat,AXAlients-32,V-SP_TEAH_FTE-3,APP_M365 KffiAe - MKnthly Enterprise Ahannel,V-AIA TEAM MEMBERS-2,DTAA_KRA_PRPX_BusKwnerEdit,DTAA_EIT_WWARP_View_AAAess,DTAA_AAK_ARS2S_JP_AKntraAt_ExAeptiKn,APP_SimKn Tatham PuTTY -X86-,V-KTV-TeAhnKlKVy-4,V-TIS-EPS-All-1,DTAA_AKK_TRIMS_VrKup_RelatiKnship_ManaVer_JPT,iPhKneUsers_VKKd_BYKD,APP_REALTEK USB VBE DRIVER 23.50.0211.2022,DTAA_AKK_TRIMS_VrKup_EnVaVement_ManaVer_JPT,DTAA_EIT_PMT_BPAN_IDaaS_ReadKnly,DKE-SP-TeAh_FTE-3,DTAA_AFV_EAPT_User,DTAS_NSK_IAS_ValidatiKnKnly1,NKtReVulatedUsersTKJKurnal-40,DTAA_AFV_EAPT_User_AKnfiiontial,MSVWk_AD_DEV_iKS_BYKD,DTAA_AFV_1WkV_AAAESS,APP_SynaptiAs DisplayLWkk VraphiAs 23.3.6400.0,ExAhanVeTeAhALT_AIA_FTE,DTAA_EIT_PSVHT_IdaaS_JPTLearner,Wave_MiArKsKft .NETDesktKpRuntime x64,PMSV-eaAKAKn-SendAs,DTAA_AFV_ADMF_TMDL_Kwner,DTAA_JPT_ITMP_SN_ITIL_USER_TEAHNKLKVY,DTAA_ADT_AZAD_LIA_SKU_KffiAe365_Teams,DTAA_TIV_Tab_ADMF_MAD_Wkt,1AAAAllUsers-31,MSV_AAD_WkfKBarrier_Enabled,DTAA_TIV_Tab_EAAK_EPPIA_Wkt,APP_WaaS_JP_Wksiders,Wave_ZKKm VideK AKmmuniAatiKns,AharlKtteDireAtKry-5,WAV_PRD_NP_1_TM_KX_Primary,MSVWk_ADT_AZAD_LIA_SKU_KffiAe365_Wktune,SredMyAppsMKbile,DTAA_TIV_Tab_ADMF_TMDL_Wkt,DTAA_AHS_PKrtal_IE_HKME,MSVTP_AallWkV_Private,PMSV-EAAKMessaVWkV-SendAs,DTAA_NSK_Wkternal_SKAial_AllKwed_Users,WkteVratedMarketWkVAllExAeptTellers-30,DTAA_AFV_MIM_TMIM_BUSWkESS_UNIT_KPERATKR,MSVTP_MessaVWkV_AhatKn,V-ETI TEAHNKLKVY FTE-3,Wave_VKKVle AhrKme,DTAA_VP_EUA_HAPA_FR_RemKval,DTAA_EIT_TRIAV_RepKrts,PMSV-eaAKAKn,SP_ALM_Read_AAAess_FWk_TeAh_DL-4,PriKrity_RemKte_AAAess_EAAK_Tier1,EITAll-4,APP_ZKKm ZKKm,MSVTP_MeetWkV_App_Aud_Vid_ExtAKnf,saEionTAKnneAt,Wave_AisAK Jabber,Wave_WkterAede MyID WWkdKws WkteVratiKn ServiAe,DTAA_ENT_HAPA_PKD0033,IMAKrpKrateAll-29,JP-TeAhnKlKVy-All-FTE-3,MSV_EM_IM_PKKl05_Users,V-SIFFERMAN FTE,EES1225AIBBldV3,MSV_EM_IMPKliAy_Standard_App_Aud_Vid_ReA_DialWk_ExtAKnf,DTAA_APD_ATK_EJRA_BSD_PRKD_JSW_users,LeVal_TeAhnKlKVy-4,Wave_KraAle Java JDK 8U x86,DEM_MiArKsKft EdVe WebView2 Runtime,DTAA_TKV_Pixel_Users,MSVTP_MeetWkV_App_Aud_Vid,VADI-RKKtTeamsPrKxyExAeptiKn,PilKt_MKbile_Users_Teams,DTAA_TIV_Tab_ADMF_DMI_BMD_Wkt,DTAA_WkD_1DIM_USER,SP-TS-All-32,AMTRADS-AllSaul-4,PMSV-EAAKMessaVWkV,Wave_WkterAede MyID Self-ServiAe App,RMSShare-45,DTAA_AFV_EAPT_VlKbalRead,APP_WktradK 911 LKAatiKn ManaVer 1.7.1,DTAA_TIV_Tab_EDQ_WkT ... View more

I have a field in my database datamodel called 'os.user'. And I have a lookup called 'userAccount'.  'userAccount' look up has a field called 'user' that is same as the 'os.user' field of database DM. I want to know if all of my 'os.user' values are present in the 'userAccount' lookup.   My requierment is to know if my lookup is sufficient and contains all the user values 'os.user'. Could use some guisance on the SPL ... View more

I want to list all the Kv store collections through SPL. something like below... | rest /servicesNS/-/- ....... unable to figure out the right rest command and the correct fields . Would appreciate any guidance.. ... View more

My dashboard panel won't work, even after changing input values , it will always say 'waiting for input'. I am unable to figure out if it is I am passing the tokens incorrectly or there is some other issue. Could use some help. ... View more

I want to be able to able to count the number of events and the median length of events per sourcetype in Splunk ? I'm trying to figure out the average/median size of evets for each sourcetype. By size, I mean the charachter length of the raw events.  and then multiply the count of events with the median size to get an idea of what sourcetypes contain big events , so that I can use the data for event size reduction if that is possible. ... View more

I want to do a field extraction for my sourcetype under the Fields-> Calculated Fields section. Confused how to draft the if condition to achieve the following logic. Condition. Some events contain  only the userid field, for those, check if it is not null/empty, then fetch the userid field as user or fill unknown Some events contain both userid and cmdid field, in this case (if the event has both these fields) cmdid is the real user field. so the logic in both cases should first compare the existence of those 2 fields and then accordingly derive. ... View more

I have doubts that this Saved Search may not be properly engineered  and very taxing in terms of how time range is specified. This Saved search is basically responsible for populating a lookup.  It ends with | outputlookup <lookup name> The range of the scheduled saved search is defined as,  earliest = -7d@h latest = now In the saved search there is a logic added before the last time, that filters the event based on last 90 days. The search ends Like this, .......... .......... ........... | stats min(firstTime) as firstTime , max(lastTime) as lastTime by dest , process , process_path , SHA256_Hash , sourcetype | where lastTime > relative_time(now(), "-90d") | outputlookup LookUpName ================================== My Question is, How would the search behave? Would its scan range cover last 90 days or will limit itself to 7 days. Which time range will take precedence ? ... View more