Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About MM0071
MM0071
Path Finder
Member since:
10-25-2022
11-16-2023
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 1 |
| Member Since | 10-25-2022 |
Activity Feed
- Posted Using multiple lookup tables in a query on Splunk Search. 11-16-2023 10:27 AM
- Posted Re: Splunk Condition Search on Splunk Search. 10-16-2023 08:31 AM
- Karma Re: Splunk Condition Search for PickleRick. 10-16-2023 08:31 AM
- Posted Re: Splunk Condition Search on Splunk Search. 10-13-2023 12:04 PM
- Posted Re: Splunk Condition Search on Splunk Search. 10-13-2023 11:52 AM
- Karma Re: Splunk Condition Search for richgalloway. 10-13-2023 11:48 AM
- Posted Re: Splunk Condition Search on Splunk Search. 10-13-2023 11:25 AM
- Posted Splunk Condition Search on Splunk Search. 10-13-2023 10:07 AM
- Karma Re: How to check 10 days prior to an event in Splunk for a failed login attempt? for PickleRick. 03-23-2023 07:05 AM
- Posted How to check 10 days prior to an event in Splunk for a failed login attempt? on Splunk Search. 03-17-2023 07:09 AM
- Karma Re: How to check 30 minutes after an event in splunk for a failed login attempt for ITWhisperer. 03-07-2023 07:29 AM
- Posted Re: How to check 30 minutes after an event in splunk for a failed login attempt on Splunk Search. 03-03-2023 01:29 PM
- Posted Re: How to check 30 minutes after an event in splunk for a failed login attempt on Splunk Search. 03-02-2023 10:30 AM
- Posted How to check 30 minutes after an event in Splunk for a failed login attempt? on Splunk Search. 02-28-2023 09:23 AM
- Got Karma for Re: Separate multiple splunk values with an OR clause?. 10-25-2022 09:20 AM
- Posted Re: Separate multiple splunk values with an OR clause? on Splunk Search. 10-25-2022 09:16 AM
- Posted Re: Separate multiple splunk values with an OR clause? on Splunk Search. 10-25-2022 08:45 AM
- Posted Separate multiple splunk values with an OR clause? on Splunk Search. 10-25-2022 08:22 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-16-2023
10:27 AM
index=netlogs [| inputlookup baddomains.csv | eval url = "*.domain."*" | fields url] NOT [| inputlookup good_domains.csv | fields domain] I don't think my search is doing what I want it to do. I would like to take the bad domains from the first lookup table and search the netlogs index to see if there are any hits. however, i would like to remove the good domains from the second lookup table from the search. Anyone know if there is a better way to do this?
... View more
10-13-2023
12:04 PM
Is it as simple as: | stats count, values(*) as * by domain < 5 I get an error trying to do | where stats count, values(*) as * by domain < 5
... View more
10-13-2023
11:52 AM
Gotcha. So how can I implement logic so only show domains that show up 5 or less times?
... View more
10-13-2023
11:25 AM
Thank you so much for the help. Can you explain to me what the follow line means? values(*) as *
... View more
10-13-2023
10:07 AM
Let's say im running a search where I want to look at domains traveled to. index=web_traffic sourcetype=domains domain IN ("*.com", "*.org*", "*.edu*") I want to do a count on how domains that have appeared less than 5 times over the search period. How can I accomplish this? I know I could do a stats count by domain but after that, I'm unable to grab the rest of the results in the index such as time, etc.
... View more
03-17-2023
07:09 AM
I have a search in Splunk that returns events for failed logins. I want to be able to check for a successful authentication from a user and an IP 10 days prior to the failed login. Is this possible via a query? index=logins | where AuthenticationResults="failed" | sort 0 - _time | eval successtime = if(AuthenticationResult=="success", _time, null())
... View more
03-03-2023
01:29 PM
Thank you greatly! This is what I was looking for! Do you know what I could do to only display failed in login attempts for users who did not authenticate after the 30 minutes? Would it be as simple as changing AuthenticationResult to "failure"?
... View more
03-02-2023
10:30 AM
Thank you a lot for this! Can you please explain me the logic of the last line?
... View more
02-28-2023
09:23 AM
I have a search in Splunk that returns events for failed logins. I want to be able to check 30 minutes after the event for that user to see if they didn't have a successful login. I'm struggling with the second part of this search. index=logins | where AuthenticationResults="failed" | eval failedLogin=strftime(_time,"%x %r")
... View more
10-25-2022
09:16 AM
1 Karma
This was perfect. Thank you. Not sure why I didn't think about this.
... View more
10-25-2022
08:45 AM
I have not. I'm very green with Splunk. How would the syntax for this work?
... View more
10-25-2022
08:22 AM
I have a text box in a splunk dashboard and I'm trying to find out how I can separate values entered into the text box that are separated by commas with a OR clause. for example:
values entered into text box: 102.99.99, 103.99.93, 203.23.21
Where this search (index=abc sourcetype=abc src_ip="$ip$") would translate to:
index=abc sourcetype=abc src_ip="102.99.99 OR 103.99.93 OR 203.23.21"
Any suggestions?
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-16-2023
03:56 PM
|
