Hello, Thank you for your support but still it did not workout. Finally I wrote a lookup gen to populate the VM data separately and added lookup to call that. Even though it servers my purpose but I would be very interested to know the right way to attain this via join. ... View more

yes DstIP and dest has same format and use same source. we have matching events all right respect to IP ... View more

got your explanation @maciep So what do you suggest to be done here If i carry signature from the 1st search and do not dedup then I will end up with duplicate data combination for DstIP and signature, which I would have extracted using values had the logic worked If I flip the logic I end up with similar issue since I need 2 fields each from primary search and sub search, so which ever way i ll have the same issue My requirement is very straightforward I needs fields DstIP,Message from index="ids I need fields DstIP,signature from index=vm I want the final table to have DstIP,Message and signature I think I am missing something simple here and causing all the confusion. HELP!! ... View more

@damiensurat Hello, I have edited the query as per your guidelines still no luck. It just shows me data o/p of outer search index="ids" Message=remote*code*execution| fields DstIP,Message | join type=left DstIP [|search index=vm sourcetype="vuln" daysago=30 cvss>9 | dedup dest| fields dest,signature | rename dest as DstIP ] | table * ... View more

@maciep I am posting a simpler version of the search: index="ids" Message=remote*code*execution [search index=vm sourcetype="vuln" daysago=30 cvss>9 | dedup dest | table dest | rename dest as DstIP ]| join dest [search index=vm sourcetype="vuln" daysago=30 cvss>9 | dedup signature | table signature ] | stats values(Message) as Message values(signature) as sig by DstIP the sub search with "index=vm: has 2 fields that i need. viz dest and signature. dest for correlation and signature to be displayed out in the final table. I have refereed below link https://answers.splunk.com/answers/120641/subsearch-returning-2-fields-and-evaluation-needed-on-one.html ... View more

Hello, I am stuck with a similar scenario and can not figure out the right way out. I want my Sub search to retrieve 2 fields out of which 1 exist in primary search the other one really needs to just hang out in the end result. I might not be able to use the join in the right manner my search: index = ids [search index=vm sourcetype="vuln" daysago=30 cvss>7 | dedup dest | table dest | rename dest as DstIP]|join dest[search index=vm sourcetype="vuln" daysago=30 cvss>7| dedup signature | table signature ] AND [search index=windows sourcetype="script" |stats first(SymantecDefsDate) as SymantecDefDate by host |eval Symdef_exp_date=relative_time(now(), "-3d@d" ) |eval SymDef_Date=strptime(SymantecDefDate,"%Y-%m-%d") |eval SymDefination_Date=if(SymDef_Date7 | dedup dest | table dest | rename dest as DstIP]|join dest[search index=vm sourcetype="vuln" daysago=30 cvss>7| dedup signature | table signature ] Subsearch 2: [search index=windows sourcetype="script" |stats first(SymantecDefsDate) as SymantecDefDate by host |eval Symdef_exp_date=relative_time(now(), "-3d@d" ) |eval SymDef_Date=strptime(SymantecDefDate,"%Y-%m-%d") |eval SymDefination_Date=if(SymDef_Date<Symdef_exp_date,"noncomplaint","complaint")| search SymDefination_Date=noncomplaint | lookup dnslookup clienthost AS host | fields clientip | dedup clientip |rename clientip as DstIP] But My join here does not give back the correct result for signature/sig in the final output. I have tried both join with 'dest' and 'DstIP' but no luck . Need your expert advise @steveyz @woodcock ... View more

Hello @mdsnmss Thank you for your response. I am trying to understand how this might work before implementing it. Since your regex just includes username, does this mean only username info will be retained and I have to make similar comma separated inputs to onboard other infos. My requirement is to convert the source log dump to something limited as below Connection logs: Aug 10 08:54:44 HOST SFIMS: Protocol: TCP, SrcIP: 10.1.1.1, OriginalClientIP: ::, DstIP: 10.2.2., SrcPort: 58457, DstPort: 80, TCPFlags: 0x0, IngressInterface: Default-VRF, EgressInterface: Prod, ConnectType: End, AccessControlRuleAction: Allow, UserName: No Authentication Required ... View more

@thambisetty_balaji Hello, I am going ahead with a similar upgrade. Did you figure out which is the correct approach that needs to be taken for this. Regards ... View more

Thank you @ssievert Adding the below in props.conf seems to do its work to some extent [my_sourcetype] BREAK_ONLY_BEFORE = SMB1Enabled Now the events are coming in below format. So its considering the default line break post the SMB1* line and then again waiting for the next matching regex. How to do it differently to merge all 6 events as part of 1 @lguinn @bwooden @kristian.kolb @woodcock ... View more

I downvoted this post because did not work ... View more

Hi @woodcock I have tried using this app and it does not seem to work out as desired. I have enabled the app but still the forwarder are running with old default password. Am I missing anything here Regards ... View more

Okay so I seem to have got the logic, strange its not working. maybe we can fix that. Bu there is a different catch. Every time the doamin name may not be the given format (1)abc(2)def(3)ghif(4) It cane be any of below 2 as well (1)abc(2)def(3) (1)abc(2)def(3)ghif(4)xyz(5) Any thoughts on that ... View more

Hi, It does not seem to work! Will it be possible for you to explain in short what logic you are using for this ? Regards Sayanta B ... View more