I have a field extraction that comes back with the literal values of 'X%'. Note that the % is part of the value returned. I now need to do searches based on the range of the value of the loss field. index=* ping sprint-uplink ( loss>0% AND loss<100% ) Is there a good native way to do this or do I need to eval / regex out the numerical values? ... View more

I'm building a daily history for one of my log sources. I'm currently using the count of events via the top command to dictate the order and values as shown below. index=foreweb ...... | top TopLevelHost by c_ip limit=10 | stats list(TopLevelHost) list(count) by c_ip | sort list(count) desc This works well. I also have a field sc_bytes present in each entry. I'd like to replace the logic for top TopLevelHost by c_ip limit=10 with something that'll work based on the sum of sc_bytes. What are my options? ... View more

I have a pivot set up as follows: Data source myfirewall Rows split on source_ip Columns include bytes_downloaded and outside_hosts . I'd like to only return the top say 5 or 10 outside_hosts along with their associated bytes_downloaded . How can I do so? I'm guessing it is somewhere in the manual but I'm getting lost in the terminology. EDIT to answer @mattness: Yes, I'm hoping to do this through the GUI. I've written nested searches and the like before and I can go back to doing so here if needed. Hoping not though. I have dozens of varying searches similar to this and it would be extremely useful to allow some of my other coworkers to make their own. outside_hosts is a string field containing a domain name or an IP address. source_ip is a string field containing a source IP address (inside the firewall) bytes_downloaded is a numeric field representing the number of bytes downloaded in a given session Each source_ip can map to one or more outside_hosts . What I need to do is make a chart of the top 10 source_ip entries based on their sum( bytes_downloaded ). Once that is completed to make the results readable I need a way to only show the top 20 outside_hosts associated with that given source_ip . Using pseudocode for the last bit of logic: top(sum(`bytes_downloaded` split by `outside_hosts`) ) limit 20. ... View more

I'm putting together a search which needs to cross correlate two data sources as well as run a nested search in order to get results I want (username, client IP, top 5 visited sites). The search for my destination hosts is working well but I'm not sure how to add the second search based on the criteria that the c_ip column matches the sourceNetworkAddress. search [search source="windows_snare_foreweb" cs_network="Internal" action="Allowed" | regex UrlDestHost != "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" | top c_ip limit=25 | table c_ip ] | regex UrlDestHost != "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" | top UrlDestHost by c_ip limit=5 | stats list(UrlDestHost) list(count) by c_ip | sort list(count) desc evtid=4624 | stats values(evtuser) by sourceNetworkAddress I'm thinking I need an append and field alias but I'm not quite sure how to implement it. ... View more

I am trying to find the top 5 UrlDestHosts per IP address for the top 25 ip addresses. I have a search which returns the raw information required: source="windows_snare_foreweb" cs_network="Internal" action="Allowed" | stats count by c_ip, UrlDestHost | stats list(UrlDestHost) list(count) by c_ip How do I add top parameters, say the top X c_ip entries (based on count) and the top Y UrlDestHosts (based on the count per value of X)? ... View more

I'm trying to correlate my printer entries along the top printer / user combination line. What I'm looking for in the way of output would be something like: printer name 1 | user name 1 | user name 1 count | user name 2 | user name 2 count | ... etc. printer name 2 | user name 3 | user name 3 count | user name 2 | user name 2 count | ... etc. I have a search prepared to locate the printer names in the first column: evtid=10 host=print1* OR host=print2* NOT evtuser=*$ | table Printer_Name | dedup Printer_Name I also have a search that provides the data I want for the remaining columns: evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=PR-EAST | chart count by Printer_Name, evtuser How do I glue these together to get the results I need? I'd rather not have to run hundreds of these queries by hand. I looked at subsearches and it doesn't look like that does quite what I need. ... View more

I have a pretty basic query which generates a large (several hundred by several hundred) table. host=XX OR host=YY print evtid="10" splunk_server="ami" | counttable evtuser, Printer_Name I need to export this resulting table to a CSV. This function is apparently known to be broken based on some of the other answers I've seen. I'm only receiving the first column of output. Is there a ready way to do what I need? ... View more