About JRamirezEnosys

JRamirezEnosys · ‎07-22-2021

My use case is the following, I have login information regarding which ASN a user logged in today on the field ASN and data from the authentication datamodel, which gives me a "list" of ASNs "values(ASN)" AS Multi_ASN I was trying to use an eval to get a YES or NO answer, if the user have login from these ASNs. There was a lot of pain trying to get the command correct, but I ended up using this eval for this type of data ASN = A1234 Multi_ASN = A1234 A2345 A3456 | eval Logged_before_from_ASN=if(IN(ASN, (split(Multi_ASN," "))) , "YES", "NO") So the split divides the values in Multi_ASN and that is compared by the "if(IN(" but unfortunately there is no highlighting for "IN" Any recommendations? This eval is working but I wonder if there is a better way to do this

JRamirezEnosys · ‎08-06-2019

Hi everybody, I was reading https://answers.splunk.com/answers/560188/logic-behind-geographically-improbable-access-dete.html and I am trying to get a better and more simple query to find geographically improbable access. My environment is not as full as these, I have atm 3 variables subject=ID of the user _time=timestamp (doh) IP=IP address from where they have logged on from IP I can obtain the fields "lat" and "lon" Then with some simple string magic I am looking at the following index=main eventtype="loginevents" subject=* | fields ip subject _time | iplocation ip | eval lat=tostring(lat), lon=tostring(lon) | eval latlon=lat.", ".lon | stats count by ip latlon My issue is that this results just give me basic statistic data, what i want is to compare the 2 last logins and see how far those 2 locations are, so it would be adding the previous login's lat and lon in different fields, any idea to apply this?

JRamirezEnosys · ‎07-16-2019

Hi all, Me and my team have noticed that from a number of emails traffic submitted by mimecast, the Subject in the email have a Pipe symbol "|" something like the following: You will get this | You wont get this | either this Splunk only add "You will get this" in the Subject field, rather than the whole string, is there anything I need to change in the extraction or is an issue in the MimeCast side?

JRamirezEnosys · ‎12-17-2018

Hello Splunkers, We've been using the Splunk_TA_mimecast_for_splunk_v2 version 2.0.1 (https://apps.splunk.com/apps/id/Splunk_TA_mimecast_for_splunk_v2) for almost a year, but on Thursday 13th of December it stopped ingesting, and the sourcetype was removed from the list of Source Types in Splunk (Settings > Data > Source types). We have then installed and configure TA-mimecast-for-splunk version 3.0.5 (https://apps.splunk.com/apps/id/TA-mimecast-for-splunk) but we are not ingesting it either. Also, we audited the Server where Splunk is installed but we cannot see any strange activity. Is anyone going through something similar or can I obtain some advise on how to solve this issue? We have follow this KBA https://community.mimecast.com/docs/DOC-2142/

JRamirezEnosys · ‎10-08-2018

Thank you Deepashiri, Hey@JRamirezEnosys, Could you try something like this: https://answers.splunk.com/answers/495493/how-do-i-use-cached-report-results-in-dashboards.html Let me know if this helps!!

JRamirezEnosys · ‎10-08-2018

It did, totally works! thank you!

JRamirezEnosys · ‎09-26-2018

Hello Splunkers, I have created a Dashboard that gets populated by a report (this report runs after hours) however, whenever I load the page this happens The process bar is on 0.0% and will never complete on its own, however after I refresh (either the whole page or that single panel) it is completed and it get populated. Btw, the report has no data in it (search did not return any events), I wonder if that is the problem. I have tried improving my Splunk deployment but nothing really seems to help, the reports load by itself without any problem the only issue is when I populate a dashboard with it. Hopefully one of you have come across something similar.

JRamirezEnosys · ‎06-06-2018

Thank you for your response FranKVI, I am currently running on 6.5.2 which does not allow me to use Trellis. I would go for 3 separate dashboard panels but how do I get the correct percentage to show on every search? I need a Search String to find the percentage of Acc, Bnc and Rej separately, is this doable ?

JRamirezEnosys · ‎06-06-2018

Hello Splunkers, I've been trying to show in a Single Value Visualization 3 different percentage values. My search looks into a single field of Email Actioning called "Act" , they are Accepted (Acc), Rejected (Rej) and Bounced (Bnc) Best I was able to do was index=email_logs Dir=inbound | timechart span=1d count by Act | untable _time Act count | eventstats sum(count) as Total by _time | eval perc=round(count*100/Total,2) | table _time Act perc | xyseries _time Act perc Whenever I send it as a Single Value it will show the Highest Value, Accepted on this case, but I don't see a way to show the Rejected or Bounced as a separate Single Value representation. Could I get some advice, Thank you.

JRamirezEnosys · ‎01-01-2018

Hi everybody, We just started to ingest SCCM v1606 Logs into our Splunk, the main goal is to see the following: -See which KB#'s (Windows Patch) are installed on a particular device. -Use a lookup Table to know the date the KB#'s were released and its severity. -Separate the logs by Operative System. -Display it on a time-chart that will let us know if the device have the latest most important patches or compliance level. I was able to achieve the first and third objective with a single SQL Query on the DB Connect SELECT DisplayName0, Publisher0, S.Name0, S.User_Name0, S.Last_Logon_Timestamp0, S.Operating_System_Name_and0 FROM "CM_SFW"."dbo"."v_Add_Remove_Programs" P Join v_R_System S on P.ResourceId = S.ResourceId Where DisplayName0 like '%KB%' The 4th objective is achievable but at this point in time I haven't been able to find a csv (objective 2) file with all the KB#'s that also contain the release dates (and a CVE would be also a great addition) I wasn't able to find the KB's release dates on the SCCM, so if you could advice of a CSV file that contain these details or if it is accessible through SCCM (and the Query).

JRamirezEnosys · ‎08-23-2017

Hi, I have the following field called OS with 6 different values and count for each value: Windows = 5 Mac = 4 Linux = 5 Mac, Windows = 10 Mac, Windows, Linux = 12 Mac, Linux = 11 The problem stand on that the real total of Windows values would be Windows,Windows+Mac,Windows,Linux (5+10+12) So I would like to separate Mac,Windows into Windows and Mac values and add them to the Windows and Mac value. At the end I would like to have something like: Windows=27 Mac=26 Linux=16 My idea is to rename them twice but it doesn't really work out for me. Any ideas or solutions are welcome. Cheers

JRamirezEnosys · ‎05-30-2017

I tried a join index=Networklogs srcip=7.7.7.7 | rename srcip as hostname | join hostname [search index="Scanresults" hostname="7.7.7.7"] Still not working

JRamirezEnosys · ‎05-30-2017

Hi everyone, I've been trying to add results from 2 different indexes using search after the pipe but it doesn't seem to work. My task is to call into 2 different indexes: One is called Networklogs and the other is called ScanResults There is a field on both indexes with the same information (an ip address) that I want to use as the primary key to correlate them. On Networklogs is called srcip and on ScanResults is called hostname From the Network logs I want the srcip and the field called app From the ScanResults I want the hostname and a field called fqdn I try the following query to mix and match both index=Networklogs srcip=7.7.7.7 | search index=ScanResults hostname=7.7.7.7 | stats count by srcip app fqdn Any advice on how to achieve this result?

JRamirezEnosys · ‎04-20-2017

Hi Splunkers, I have a query that gives me the following fields I want to work with. username Country (after using iplocation on src_ip) Some usernames have login from more than 2 countries. I want to see it on a chart that shows me the top 5 usernames based on how many countries they have log in and which countries are those. I believe I need to use dc(Country) at some point This is my search string index=main event=sso status=success ip!=10.0.0.0/8 | regex subject=^\D\d+$ | iplocation ip | stats dc(Country) by subject

Posts	14
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎04-18-2017

Online Status	Offline
Date Last Visited	‎07-28-2021 11:09 PM

Compare a field with a single string against a Mul...

Geographically improbable Access Using iplocation

Issues with Mimecast 3.1.3 regarding Subjects sepa...

Problems with mimeCast TA for Splunk

Dashboard populated by a report never stops loadin...

Show the a particular percentage using Single Valu...

SCCM Windows KB# and Dates

Help with the logic to make this count my fields c...

Correlating Data from 2 Indexes

Stats Distinct Count (X) + X[Values]