About adamscaa1

adamscaa1 · ‎08-11-2023

Hello Giuseppe, Yes, I have been using the CIM app for some time now. I am at version 5.1.1.

adamscaa1 · ‎08-10-2023

Downloaded SA-cim_Vladiator app on my splunk enterprise , however it's stuck on search type= _raw and Target Datamodel= "Network_Traffic" which is grayed out and I can't select any different datamodels. Could anyone provide any info to help me get this working correctly. Thanks all

adamscaa1 · ‎03-15-2023

Thanks all, I was able to accomplish what I needed using the following. To get me the hostnames matching events from my lookup this worked. <search> [| inputlookup <lookup file> | rename HostName as host | fields host | format] To get "HostNames" of which no events were found meaning they are not sending anything. This worked... | inputlookup <lookup file> where NOT [ search <base search> | stats values(host) as HostName ] Thanks again to all who help me with this.

adamscaa1 · ‎03-15-2023

Thanks, that works perfect..

adamscaa1 · ‎03-15-2023

I have about 30 host names on my lookup.

adamscaa1 · ‎03-14-2023

Thank you, this works perfect to get me the host matching events. So, now I need to see the "HostName" of which no events were found meaning they are not sending anything. Using a NOT it just gives me all host not on the lookup list. How can I get a list of the hostnames from the lookup with no recorded events at all. <search> NOT [| inputlookup <lookup file> | rename HostName as host | fields host | format] Thanks,

adamscaa1 · ‎03-14-2023

I have a lookup file of HostNames HostName Host1 Host2 Host3 Host4 Host5 I would like to create a search to include events that are only from these hostnames listed in my lookup file. How do I do this.? Which "host" field matches the "Hostname" field in my lookup file. An example would be, I am looking for which of these host that are sending windows security logs or not. I know all these systems should be, but some are not, and I want to know which ones are and which one are not using the lookup file.

Posts	8
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎03-13-2023

Online Status	Offline
Date Last Visited	‎12-08-2023 05:36 PM

Why is SA-cim_Vladiator stuck on one datamodel?

How to find events for only host names listed in m...

Re: Why is SA-cim_Vladiator stuck on one datamodel...

Why is SA-cim_Vladiator stuck on one datamodel?

Re: Find events for only host names listed in my l...

Re: Find events for only host names listed in my l...

Re: Find events for only host names listed in my l...

Re: Find events for only host names listed in my l...

How to find events for only host names listed in m...