Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rkoster
rkoster
Explorer
Member since:
04-08-2016
10-05-2022
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 04-08-2016 |
Activity Feed
- Karma Re: Why does the split function fail for list_split_failure_1 and 2 but succeeds for list_split_success? for johnhuang. 10-05-2022 03:00 PM
- Posted Why does the split function fail for list_split_failure_1 and 2 but succeeds for list_split_success? on Splunk Search. 10-05-2022 01:06 PM
- Karma Re: A search that makes searches and executes them for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: A search that makes searches and executes them for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Why I cannot save a search containing a macro? for jspears. 06-05-2020 12:47 AM
- Karma Re: How to count the number of dots in a domain name for eashwar. 06-05-2020 12:46 AM
- Posted Re: Splunk Enterprise Security: Top Notable Event Sources: Whitelist on Splunk Enterprise Security. 10-31-2018 06:25 AM
- Posted Re: In the Splunk Enterprise Security Incident Review Dashboard, is it possible to change the default status label? on Splunk Enterprise Security. 09-22-2018 08:58 AM
- Posted Re: Why I cannot save a search containing a macro? on Reporting. 07-13-2016 10:15 AM
- Posted Re: A search that makes searches and executes them on Splunk Search. 04-12-2016 03:42 PM
- Posted Re: A search that makes searches and executes them on Splunk Search. 04-12-2016 10:30 AM
- Posted A search that makes searches and executes them on Splunk Search. 04-08-2016 03:46 PM
- Tagged A search that makes searches and executes them on Splunk Search. 04-08-2016 03:46 PM
- Tagged A search that makes searches and executes them on Splunk Search. 04-08-2016 03:46 PM
- Tagged A search that makes searches and executes them on Splunk Search. 04-08-2016 03:46 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
10-05-2022
01:06 PM
| makeresults count=1 | eval list_split_failure_1 = "fail:,searching old data:,searching new" | eval list_split_failure_2 = "fail:,searching old ata:,searching new" | eval list_split_success = "fail:,searching old qata:,searching old dta:,searching old ta:,searching new" | eval list_split_failure_1 = split(list_split_failure_1, ",") | eval list_split_failure_2 = split(list_split_failure_2, ",") | eval list_split_success = split(list_split_success, ",")
Can someone help me to understand why the split function fails for list_split_failure_1 and 2 but succeeds for list_split_success?
... View more
10-31-2018
06:25 AM
You can generate fewer notable events from that source IP address (i.e. tune the correlation searches that are triggering with that src) as Martin suggests or you can modify the report that is used to populate that panel (Report Name: Notable - Top Notable Event Sources).
| `es_notable_events`
| search timeDiff_type=current src!=unknown src!="<whitelisted address>"
| stats sparkline(sum(count),30m) as sparkline,dc(rule_name) as correlation_search_count,dc(security_domain) as security_domain_count,sum(count) as count by src
| sort 100 - count,correlation_search_count
... View more
09-22-2018
08:58 AM
You cannot modify the Incident Review link itself but you can create a new collection and views (or just a view if you prefer) by editing the XML of the navigation UI. Adding a collection will create a new drop down navigation menu that will allow you to select your customized search(es) against notable events.
Click: Settings > User Interface > Navigation menus > default (app: SplunkEnterpriseSecuritySuite)
Or simply browse to: {your splunk addr}/en-US/manager/SplunkEnterpriseSecuritySuite/data/ui/nav/
Then click the Nav name: default
Edit the XML by adding the collection tags and links between other view tags.
My collection XML code looks like this:
<collection label="Alarm Queue">
<a href='/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-3d%40d&latest=now&form.status_form=1&form.status_form=2&form.owner_form=unassigned&form.security_domain_form=*&form.srch=&form.selected_urgency=critical&form.selected_urgency=high&form.selected_urgency=medium&form.selected_urgency=low&form.selected_urgency=informational'>Default - Alarm Queue</a>
<a href='/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-7d%40d&latest=now&form.status_form=0&form.status_form=2&form.status_form=3&form.status_form=4&form.owner_form=*&form.security_domain_form=*&form.srch=&form.selected_urgency=critical&form.selected_urgency=high&form.selected_urgency=medium&form.selected_urgency=low&form.selected_urgency=informational'> Review - Not Closed</a>
</collection>
I have the code shown above between the following code in the XML:
<view name="ess_security_posture"></view>
[the code above]
<view name="incident_review"></view>
[rest of the XML for your navigation ui]
This results in the following navigation UI:
The "Default - Alarm Queue" looks like this:
... View more
07-13-2016
10:15 AM
Review the permissions on the Macro; ensure that it is shared and has the appropriate Read access configured.
... View more
04-12-2016
03:42 PM
I think that will work! Thank you!
It is important that the Comment field within the CSV has any quotes escaped otherwise the eval command that is created terminates too early.
To remove the non-matching regexs (to set this up for an alarm) I added this to your query:
| where Comment!=""
As implemented here is the full query:
sourcetype=proxy
[ inputlookup regexs.csv
| eval search = "| eval Comment = if(match(uri, \"".RegEx."\"), \"".Comment."\", Comment) "
| fields search
| mvcombine search
| nomv search
]
| stats values(Comment) AS Comment by uri
| where Comment!=""
... View more
04-12-2016
10:30 AM
Hi Martin,
Thanks for taking some time to review and provide feedback.
I will edit the search in the question to include the appropriately ordered syntax; I re-ordered the query a bit while I was posting in an attempt to make it a bit more readable and thought through.
Assembling one large regex, while it would return results, will not reach my end goal which would include the "Comment" field from the lookup. I assumed that multisearch would allow for transforming commands such as adding a:
| stats values(Comment) AS Comment values(uri) AS uri by domain
However multisearch will not do that: Error in 'multisearch' command: Multisearch subsearches may only contain purely streaming operations (subsearch 1 contains a non-streaming command.)
So I am left with a scenario where I have two columns in a CSV with multiple rows: RegEx, Comment
I want to search my proxy logs for matches on each regex in order to return the Comment, domain, and uri by domain.
... View more
04-08-2016
03:46 PM
So I have this search that I believe makes other searches from a list of regexs that I have stored in a csv.
[ | inputlookup regex_test.csv
| eval search_this = "[search sourcetype=proxy | eval Comment=\""+Comment+"\" | regex uri=\""+RegEx+"\"]"
| stats values(search_this) AS all_searches
| eval search="| multisearch "
| eval search=search+mvjoin(all_searches, " ")
| fields search ]
The above search fails:
Search process did not exit cleanly, exit_code=0, description="killed by signal 6: Aborted". Please look in search.log for this peer in the Job Inspector for more info.
This search has encountered a fatal error and has been marked as zombied.
However the search that is created from the query above does not fail when you input into the search bar (yes it returns results on match):
| multisearch [search sourcetype=proxy| eval Comment="EITest v1" | regex uri="^http:\/\/(?:(?!www|authorize|sdranch|azbar|finra|porsche|money|blog|forums?|it)[^\x2e]+\.[^\x2e]+\.com[^\x2f]*|[^\x2e]+\.tk)\/[ik](?=[^\n]{0,500}[a-z\x2d]{17,100})(?=[^\n]{0,500}[a-z\/\x2d]{60,200})(?:[a-z\x2d]+\/){4,32}(?:index\.html)?$"] [search sourcetype=proxy| eval Comment="EITest v2" | regex uri="^http:\/\/[^\x2f]+\.[a-z]{2}\/(?=[^\x3f]+[a-z0-9]{17,}\/)(?:[a-z0-9]+\/){2,}(?:index\.php)?$"]
Apart from additional caffeine, what am I missing to make this great success?
Have I chosen the wrong command or the wrong way to go about creating this search of searches? The goal is to have a list of RegEx,Comment and search for matches against each RegEx in the list.
Thanks for taking some time to think about this one!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-05-2022
04:39 PM
|
