About gordone

gordone · ‎06-14-2023

Hi ITWhisperer, Thanks for taking the time to respond. I had thought I had responded to this, but it seems the forum ate my reply. Mock Output: _______________________________________________________________________________ Time Designated_Field Sub-Field Name 21:21 01 - Logon User Host Domain 21:22 02 - Logoff User Host Domain 21:23 04 - IP Address Assigned Host Domain NS Server IP Type _____________________________________________________________________________ NOTE: Designated_Field is a field, whose values are extracted and displayed per event, in the third column are the sub-field names associated with the values in the second column.

gordone · ‎06-13-2023

Hi ITWhisperer, Thanks for engaging my question. Reponse: ---------------------------------- Time | Designated_Field | Sub-Field ____________________________________________________________________________ 21:23 01 - Logon User Host Logon Domain 21:25 02 - Logoff User Host Logon Domain ________________________________________________________________________________ So note that (01 - Logon, 02 - Logoff) are the values in the field: Designated_Field. By contrast, (User, Host, Logon Domain) are field names (like Designated_Field).

gordone · ‎06-09-2023

Hi guys, Looking for help framing a query for the following scenario: index=index "designated field" Events show the that there are multiple values for the field (these are log message types): Type1 Type2 Type3 .... TypeN Want to enumerate all of the fields that are associated with each: designated_field.TypeN (i.e. each log message type has sub-fields associated with each log message type.) So for Type1: Field1_Type1 Field2_Type1 Field3_Type1 for Type2: Field1_Type1 Field2_Type2 etc. ====================================== So I am imagining my query goes like this: index=index1 designated_field | <enumerate each of the values in designated_field> | <pull our the field names for each of the values that were enumerated> | <form a table with a column listing the values and then a second column showing all of the field names associated with each value>

gordone · ‎01-25-2017

So, I am not clear whether this has been asked before, but I'll ask it directly. I want to present the results of my search as a table of selected fields, without having to invoke the stats count by {Field1},{Field 2}, etc. I suspect there is going to be some use of the eval command. sourcetype=firewall dest_port>=3500 dest_port<=3800 | stats count by srcip,dest,dest_port also, I would like to be able to aggregate the source IPs and/or the port as you might see in the Threat Activity dashboard. Thanks beforehand for any help.

gordone · ‎01-25-2017

Care to say what you did/tweaked?

gordone · ‎08-13-2016

We are still waiting for an acceptable solution here. Messing with the data models in ES can be tricky...

Posts	6
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎08-13-2016

Online Status	Offline
Date Last Visited	‎06-14-2023 12:28 PM

How to extract field names against values in one (...

How to present my search results as a table of sel...

Re: How to extract field names against values in o...

Re: How to extract field names against values in o...

How to extract field names against values in one (...

How to present my search results as a table of sel...

Re: Fields & Transforming Search Results

Re: Splunk App for Enterprise Security: How to edi...