Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jhampton_3rd
jhampton_3rd
Explorer
Member since:
12-08-2016
04-27-2021
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 12-08-2016 |
Activity Feed
- Posted This search has encountered a fatal error and has been marked as zombied. on Splunk Search. 12-01-2020 08:18 AM
- Posted Re: Match two field values utilizing a wildcard on All Apps and Add-ons. 11-24-2020 06:42 AM
- Posted Match two field values utilizing a wildcard on All Apps and Add-ons. 11-24-2020 05:50 AM
- Got Karma for Why is "stats latest(field) as FIELDNAME" not displaying any values under FIELDNAME in search results?. 06-05-2020 12:48 AM
- Posted Re: Why is "stats latest(field) as FIELDNAME" not displaying any values under FIELDNAME in search results? on Splunk Search. 12-15-2016 08:57 PM
- Posted Why is "stats latest(field) as FIELDNAME" not displaying any values under FIELDNAME in search results? on Splunk Search. 12-15-2016 12:07 PM
- Tagged Why is "stats latest(field) as FIELDNAME" not displaying any values under FIELDNAME in search results? on Splunk Search. 12-15-2016 12:07 PM
- Tagged Why is "stats latest(field) as FIELDNAME" not displaying any values under FIELDNAME in search results? on Splunk Search. 12-15-2016 12:07 PM
- Tagged Why is "stats latest(field) as FIELDNAME" not displaying any values under FIELDNAME in search results? on Splunk Search. 12-15-2016 12:07 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 |
12-01-2020
08:18 AM
I'm trying to optimize this report to successfully run without errors. It will currently run for 3-5 hours and grow to 750+MB then fails, then starts again and runs for 15 hours and grow to 8MB and complete. After it completes, there are no results in the report. This is the query running over last 30 days. index=web OR index=web_long sourcetype="*iis*" NOT ("HealthCheck" OR "localhost" OR "F5" OR "*LtmActivityMonitor*") NOT cs_uri_stem="/" | eval id=coalesce(upper(app_id), upper(id)) | rename id AS AppId | join type=inner AppId, host overwrite=false [ search index=im sourcetype=db LogType="web" earliest=-45d | eval host=lower(ServerName) ] | head 500000 | eval missing_field=mvappend( case(isnull(c_ip), "c_ip"), case(isnull(cs_bytes), "cs_bytes"), case(isnull(cs_host), "cs_host"), case(isnull(cs_method), "cs_method"), case(isnull(cs_uri_stem), "cs_uri_stem"), case(isnull(cs_version), "cs_version"), case(isnull(date), "date"), case(isnull(s_computername), "s_computername"), case(isnull(s_ip), "s_ip"), case(isnull(s_port), "s_port"), case(isnull(sc_bytes), "sc_bytes"), case(isnull(sc_status), "sc_status"), case(isnull(cs_Referer), "cs_Referer"), case(isnull(cs_User_Agent), "cs_User_Agent"), case(isnull(time), "time"), case(isnull(x_forwarded_for), "x_forwarded_for") ) | fillnull value=None | mvexpand missing_field | where missing_field != "" | stats latest(_raw) AS latest_raw BY AppId, index, sourcetype, missing_field, host, source | stats values(missing_field) AS missing_field BY AppId, index, sourcetype, host, latest_raw, source | table AppId, index, sourcetype, missing_field, host, latest_raw, source | where missing_field!= ""
... View more
Labels
- Labels:
-
eval
-
search job inspector
-
stats
-
table
11-24-2020
06:42 AM
Thanks. Worked like a charm!!!
... View more
11-24-2020
05:50 AM
Has anyone had to match two fields values using a wildcard in one of the fields values. My scenario, I have a host field that looks like this host=server1 , I have a dest field like this, dest=server1.www.me & dest=server1.xxx.com & dest=comp1. I'm trying to find all instances where the host field with a wildcard matches the dest field. This is the query I have so far without the filter index="winevents" host=* | stats dc(dest) as total values(dest) count by host | search total > 1 results look like this: host total values(dest) server1 3 server1.www.me server1.xxx.com comp1 How can I filter only where the host field somewhat matches the dest field. So results will look like this excluding the 3rd dest name of comp1. host total values(dest) server1 2 server1.www.me server1.xxx.com I tried this but get no results index="winevents" host=*| eval host=host + "*" | search host=dest | stats dc(dest) as total values(dest) count by host | search total > 1
... View more
Labels
- Labels:
-
search
12-15-2016
08:57 PM
Thanks for your help. That worked!
... View more
12-15-2016
12:07 PM
1 Karma
My last stats command is not showing the values by sublocation. It shows each sublocation but no values are shown.
index=###### sourcetype=#######
| lookup csirt_asset_list ip OUTPUT sublocation
| search hasBeenMitigated=0 sublocation=*
| stats dc(ip) as Total1 by sublocation
| join [ search index=##### sourcetype=##### pluginID<1000000 baseScore>0
| lookup csirt_asset_list ip OUTPUT sublocation
| search hasBeenMitigated=0 sublocation=*
| stats dc(ip) as Total2 by sublocation]
| join [search index=##### sourcetype=##### pluginID<1000000 baseScore>0
| lookup csirt_asset_list ip OUTPUT sublocation
| search hasBeenMitigated=0 sublocation=*
| stats count as counted by baseScore, sublocation
| fields + sublocation, baseScore, counted
| sort-baseScore
| lookup weight_lookup baseScore OUTPUT wmultiplier
| eval aaa=(counted * wmultiplier)
| eventstats sum(aaa) as test1, sum(counted) as test2
| eval bbb=(test1 / test2)
| eval bbb=round(bbb,2)]
| eval cvss_overall_score=bbb*(Total2/Total1)
| stats latest(cvss_overall_score) as "CVSS Overall Score" by sublocation
OUTPUT LOOKS LIKE THIS
sublocation CVSS Overall Score
abc
def
ghi
Nothing is showing under CVSS Overall Score. If I use:
| stats latest(cvss_overall_score) as "CVSS Overall Score"
It shows the CVSS Overall Score.
Thanks for your help
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-27-2021
01:58 PM
|
