About sameeripro

sameeripro · ‎09-25-2017

I am still getting single color if i use the query eval color=if(protocol=tcp,"#FF0000","#0000FF")

sameeripro · ‎05-30-2017

@woodcock i am seeing mode=sed "s/\D//g" type of regex for first time can you throw some light on this as i want to learn.

sameeripro · ‎05-30-2017

@jkat54 Thank you very much

sameeripro · ‎05-30-2017

@woodcock Even this query worked thank you very much @woodcock | eval digits=_raw | rex field=digits mode=sed "s/\D//g"

sameeripro · ‎05-30-2017

In this query i am getting results only if the string ends with a number. Example for 10.0.0.1 i am getting 1 for 123example567.com i am getting zero results

sameeripro · ‎05-30-2017

in rex field=_raw "(?\d+)$" iam getting only the last part Example 10.0.0.1 i am getting 1 123example567.com i am getting 567

sameeripro · ‎05-30-2017

this worked as i wanted to extract numbers only from a single field that is "query" i used | eval digits=replace(query,"\D","") | table digits

sameeripro · ‎05-29-2017

i need to extract all the numbers in the below string. I am using "(?\d+[0-9])" but its not extracting zeros and i am getting only 53 as the answer 0.0.0.53.IN-BRR.CRPD 1.0.0.127.icmpbugtest.157.kn-ddr.prpd I have to get an answer : 00053100127157

sameeripro · ‎03-28-2017

The generated TA has to be extracted twice then you will get a folder which includes files like app,output.... so once you push this folder to indexer it will start forwarding the logs

sameeripro · ‎03-22-2017

what did you to make it running as i am not receiving the logs from Splunk to Arcsight connector

sameeripro · ‎10-18-2015

Go to directory /opt/splunk/etc/apps ls rm -rf [app name] Restart splunk

sameeripro · ‎08-10-2015

I am using the transaction command, but the events are not collated when they took place at the same time and directory eventtype=ossec integrity HKEY NOT tag::eventtype=noise | transaction reporting_host,file_dirname

Posts	12
Solutions	0
Karma Given	3
Karma Received	5
Member Since	‎03-25-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How do i write regex to extract all the numbers in...

Using the transaction command, why are events from...

Re: Mulit-Color eval, causes black outline

Re: How do i write regex to extract all the number...

Re: How do i write regex to extract all the number...

Re: How do i write regex to extract all the number...

Re: How do i write regex to extract all the number...

Re: How do i write regex to extract all the number...

Re: How do i write regex to extract all the number...

How do i write regex to extract all the numbers in...

Re: Splunk App for CEF 2.0: Is receiving "Invalid ...

Re: Splunk App for CEF not sending data

Re: How do I remove an app?

Using the transaction command, why are events from...