cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Vfinney
Observer
Member since: ‎10-05-2017
‎01-13-2021
Community Statistics
Posts 11
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎10-05-2017
Activity Feed
View All

Convert Avg_Session_Time from seconds to mm:ss

by in Reporting
‎10-02-2020 11:03 AM
‎10-02-2020 11:03 AM
I need assistance with converting the Avg_Session_Time from seconds to minutes and seconds. Here is my current search index=kdol_7 sourcetype=ms:iis:auto dest_ip=10.140.14.228 | transaction CF_Connecting_IP | stats avg(duration) AS Avg_Session_Time The column labeled current is the current result.  The column labeled desired is what I need assistance with.  Thanks in advance.    Current Desired Avg_Session_Time Avg_Session_Time 1045.2798365917713 17:41 ... View more
Labels

Help building regex for searches based on cs_usern...

by in Splunk Search
‎05-20-2020 11:48 AM
‎05-20-2020 11:48 AM
I'm having no luck building a regex to match cs_usernames . What I'm looking for are two separate searches both based on the cs_username field. The first search is to find all instances where the usernames are in all CAPS. The second search is to find usernames that end in at least two digits. Example of logs are below: 2020-05-15 04:58:34 10.140.14.228 POST /NotAvailable.aspx - 80 Gerardot 10.140.15.235 Mozilla/5.0+(Linux;+Android+9;+SM-G960U)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/74.0.3729.136+Mobile+Safari/537.36 302 0 0 15 172.69.69.111 2020-05-15 04:57:19 10.140.14.228 POST /Account/Login.aspx - 80 Kaitlyn1230 10.140.15.235 Mozilla/5.0+(iPhone;+CPU+iPhone+OS+13_4+like+Mac+OS+X)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+GSA/107.0.310639584+Mobile/15E148+Safari/604.1 200 0 0 46 162.158.75.109 2020-05-15 04:54:24 10.140.14.228 POST /PaymentInfo.aspx - 80 Emulbah 10.140.15.235 Mozilla/5.0+(Windows+NT+6.1;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/81.0.4044.138+Safari/537.36 302 0 0 46 172.68.150.39 ... View more

Re: Regex User name from Symantec logs

by in All Apps and Add-ons
‎01-17-2020 11:47 AM
‎01-17-2020 11:47 AM
That worked perfectly. Thank you. ... View more

Regex User name from Symantec logs

by in All Apps and Add-ons
‎01-17-2020 07:46 AM
‎01-17-2020 07:46 AM
We are having some issues with extracting fields from our symantec logs. While our team is working through this issue, I would like some help using regex to extract user names. 2020-01-16 08:00:36,Critical,ASPRARWB1,Event Description: [SID: 30413] Web Attack: Passwd File Download Attempt attack blocked. Traffic has been blocked for this application: C:\WINDOWS\SYSTEM32\INETSRV\W3WP.EXE,Local Host IP: 127.0.0.1,Local Host MAC: 000000000000,Remote Host Name: ,Remote Host IP: 127.0.0.1,Remote Host MAC: 000000000000,Outbound,TCP,Intrusion ID: 0,Begin: 2019-11-27 14:56:07,End: 2019-11-27 14:56:07,Occurrences: 1,Application: C:/WINDOWS/SYSTEM32/INETSRV/W3WP.EXE,Location: Default,User: pxmacct,Domain: DOL,Local Port: 53937,Remote Port: 5112,CIDS Signature ID: 30413,CIDS Signature string: Web Attack: Passwd File Download Attempt,CIDS Signature SubID: 74503,Intrusion URL: www.arppapi.dol.ks.gov/cgi-bin/ion-p.exe?page=../../../../../etc/passwd,Intrusion Payload URL: ,SHA-256: 6CD7CC4B72DB91F168C36C500C1BE9AE391C1FF09CD65295BB24267D35373FD9,MD-5: 2020-01-16 08:00:31,Critical,ASPRARWB1,Event Description: [SID: 20521] Web Attack: SGI InfoSearch fname Exec CVE-2000-0207 attack blocked. Traffic has been blocked for this application: C:\WINDOWS\SYSTEM32\INETSRV\W3WP.EXE,Local Host IP: 127.0.0.1,Local Host MAC: 000000000000,Remote Host Name: ,Remote Host IP: 127.0.0.1,Remote Host MAC: 000000000000,Outbound,TCP,Intrusion ID: 0,Begin: 2019-11-27 14:56:01,End: 2019-11-27 14:56:01,Occurrences: 1,Application: C:/WINDOWS/SYSTEM32/INETSRV/W3WP.EXE,Location: Default,User: pxmacct,Domain: DOL,Local Port: 53933,Remote Port: 5112,CIDS Signature ID: 20521,CIDS Signature string: Web Attack: SGI InfoSearch fname Exec CVE-2000-0207,CIDS Signature SubID: 75437,Intrusion URL: www.arppapi.dol.ks.gov/cgi-bin/infosrch.cgi?cmd=getdoc&db=man&fname=|/bin/id,Intrusion Payload URL: ,SHA-256: 6CD7CC4B72DB91F168C36C500C1BE9AE391C1FF09CD65295BB24267D35373FD9,MD-5: ... View more

Re: How to extract URL into a new field?

by in Splunk Search
‎11-25-2019 07:29 AM
‎11-25-2019 07:29 AM
Sorry... data certainly would help. Not sure what I was thinking. rec_type=71 tcp_flags=0 sec_intel_event=No monitor_rule_8=0 client_version="" monitor_rule_7=N/A monitor_rule_4=N/A snmp_out=0 monitor_rule_2=N/A ssl_server_name="" monitor_rule_1=N/A dest_pkts=8 sensor=ipkdol02p last_pkt_sec=1574690104 ssl_flow_error=0 ssl_url_category=0 src_ip=10.140.6.154 ssl_rule_id=0 dns_rec_id=0 src_port=59057 ssl_cert_fingerprint=0000000000000000000000000000000000000000 monitor_rule_6=N/A rec_type_simple=RNA event_desc="Flow Statistics" first_pkt_sec=1574690104 security_context=00000000000000000000000000000000 netflow_src=00000000-0000-0000-0000-000000000000 has_ipv6=1 monitor_rule_5=N/A ssl_actual_action=Unknown src_autonomous_system=0 src_bytes=863 connection_id=40461 event_usec=0 dest_autonomous_system=0 dest_mask=0 monitor_rule_3=N/A dest_ip_country="united states" iface_ingress=vrf client_app="SSL client" user_agent="" ssl_flow_status=Unknown snmp_in=0 file_count=0 dest_ip=216.58.193.142 ssl_ticket_id=0000000000000000000000000000000000000000 dest_tos=0 fw_rule_reason=N/A sinkhole_uuid=00000000-0000-0000-0000-000000000000 fw_policy=00000000-0000-0000-0000-00005dd129e8 sec_intel_ip=N/A ssl_flow_messages=0 ssl_cipher_suite=TLS_NULL_WITH_NULL_NULL http_referrer="" src_mask=0 legacy_ip_address=0.0.0.0 ssl_version=Unknown ssl_flow_flags=0 event_sec=1574693323 dns_query="" url_category="Search Engines" ip_proto=TCP dest_port=443 url=https://fcmatch.google.com ssl_server_cert_status="Not Checked" mac_address=00:00:00:00:00:00 netbios_domain="" dns_ttl=0 src_tos=0 ssl_policy_id=00000000000000000000000000000000 ssl_session_id=0000000000000000000000000000000000000000000000000000000000000000 iface_egress=outside num_ioc=0 referenced_host="" event_type=1003 dest_bytes=4538 dns_resp_id=0 user="No Authentication Required" ip_layer=0 fw_rule="Default Action" fw_rule_action=Allow rec_type_desc="Connection Statistics" ssl_expected_action=Unknown app_proto=HTTPS vlan_id=0 sec_zone_ingress=Internal-ASA sec_zone_egress=External-ASA event_subtype=1 http_response=0 web_app=Google url_reputation="Well known" src_ip_country=unknown src_pkts=8 instance_id=1 ips_count=0 rec_type=71 tcp_flags=0 sec_intel_event=No monitor_rule_8=0 client_version="" monitor_rule_7=N/A monitor_rule_4=N/A snmp_out=0 monitor_rule_2=N/A ssl_server_name="" monitor_rule_1=N/A dest_pkts=10 sensor=ipkdol02p last_pkt_sec=1574690104 ssl_flow_error=0 ssl_url_category=0 src_ip=10.140.6.154 ssl_rule_id=0 dns_rec_id=0 src_port=59066 ssl_cert_fingerprint=0000000000000000000000000000000000000000 monitor_rule_6=N/A rec_type_simple=RNA event_desc="Flow Statistics" first_pkt_sec=1574690104 security_context=00000000000000000000000000000000 netflow_src=00000000-0000-0000-0000-000000000000 has_ipv6=1 monitor_rule_5=N/A ssl_actual_action=Unknown src_autonomous_system=0 src_bytes=2750 connection_id=40463 event_usec=0 dest_autonomous_system=0 dest_mask=0 monitor_rule_3=N/A dest_ip_country="united states" iface_ingress=vrf client_app="SSL client" user_agent="" ssl_flow_status=Unknown snmp_in=0 file_count=0 dest_ip=198.8.70.129 ssl_ticket_id=0000000000000000000000000000000000000000 dest_tos=0 fw_rule_reason=N/A sinkhole_uuid=00000000-0000-0000-0000-000000000000 fw_policy=00000000-0000-0000-0000-00005dd129e8 sec_intel_ip=N/A ssl_flow_messages=0 ssl_cipher_suite=TLS_NULL_WITH_NULL_NULL http_referrer="" src_mask=0 legacy_ip_address=0.0.0.0 ssl_version=Unknown ssl_flow_flags=0 event_sec=1574693323 dns_query="" url_category="Web Advertisements" ip_proto=TCP dest_port=443 url=https://p.rfihub.com ssl_server_cert_status="Not Checked" mac_address=00:00:00:00:00:00 netbios_domain="" dns_ttl=0 src_tos=0 ssl_policy_id=00000000000000000000000000000000 ssl_session_id=0000000000000000000000000000000000000000000000000000000000000000 iface_egress=outside num_ioc=0 referenced_host="" event_type=1003 dest_bytes=4843 dns_resp_id=0 user="No Authentication Required" ip_layer=0 fw_rule="Default Action" fw_rule_action=Allow rec_type_desc="Connection Statistics" ssl_expected_action=Unknown app_proto=HTTPS vlan_id=0 sec_zone_ingress=Internal-ASA sec_zone_egress=External-ASA event_subtype=1 http_response=0 web_app="Rocket Fuel" url_reputation="Benign sites with security risks" src_ip_country=unknown src_pkts=11 instance_id=1 ips_count=0 ... View more

How to extract URL into a new field?

by in Splunk Search
‎11-25-2019 06:10 AM
‎11-25-2019 06:10 AM
What would be a command to extract the url and create a new field from Cisco eStreamer logs using the rex command? ... View more

Extract data from URL string

by in Splunk Search
‎07-30-2019 11:43 AM
‎07-30-2019 11:43 AM
I am trying to extract the file types, file names, and URLs from proxy logs for monitoring purposes. Here is what I'm looking for. Thanks in advance for any and all assistance. URL Filetype Filename http://dmp.truoptik.com .gif sync http://r14---sn-bvvbax jpl.gvt1 .exe Chrome_updater http://workforce-ks.com/ .pdf 2019-One-Stop-Advisory-Council-Meeting-Packet Proxy logs examples: 7/30/19 1:29:52.000 PM Jul 30 13:29:52 10.140.24.233 Jul 30 13:29:52 Access_Logs_Splunk: Info: 1564511389.352 80 10.140.6.27 TCP_MISS/204 793 GET http://dmp.truoptik.com/239e300e6dca3b53/sync.gif?dm=ib.adnxs.com&fck=6298473322644763945 "DOL\sroth@KDOL_Web_Auth" DIRECT/dmp.truoptik.com - DEFAULT_CASE_12-KDOL_Access_Policy-KDOL_Web_Identity-NONE-NONE-NONE-DefaultGroup <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",79.30,0,-,"-","-",-,"-",-,-,"-","-",-,-,"-"> - 7/30/19 1:29:42.000 PM Jul 30 13:29:42 10.140.24.233 Jul 30 13:29:42 Access_Logs_Splunk: Info: 1564511379.248 324 10.140.10.21 TCP_MISS/206 1587824 GET http://r14---sn-bvvbax jpl.gvt1.com/edgedl/release2/chrome/AOnIEhGH7WaH0jVMgWzb_TU_76.0.3809.87/76.0.3809.87_75.0.3770.142_chrome_updater.exe?cms_redirect=yes&mip=165.201.56.130&mm=28&mn=sn-bvvbax-hjpl&ms=nvh&mt=1564511187&mv=m&mvi=13&nh=EAE&pl=16&shardbypass=yes "DOL\dingels@KDOL_Web_Auth" DIRECT/r14---sn-bvvbax-hjpl.gvt1.com application/octet-stream DEFAULT_CASE_12-KDOL_Access_Policy-KDOL_Web_Identity-NONE-NONE-NONE-DefaultGroup <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",39205.53,0,-,"-","-",-,"-",-,-,"-","-",-,-,"-"> - 7/30/19 1:33:50.000 PM Jul 30 13:33:50 10.140.24.234 Jul 30 13:33:50 Access_Logs_Splunk: Info: 1564511627.609 1779 10.140.4.14 TCP_MISS/200 3461685 GET http://workforce-ks.com/wp-content/uploads/2015/05/08.01.2019-One-Stop-Advisory-Council-Meeting-Packet.pdf "DOL\nstruckhoff@KDOL_Web_Auth" DIRECT/workforce-ks.com application/pdf DEFAULT_CASE_12-Social_Media_Access_Policy-KDOL_Web_Identity-NONE-NONE-NONE-DefaultGroup <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",15566.88,0,-,"-","-",-,"-",-,-,"-","-",-,-,"-"> - 7/30/19 1:33:11.000 PM Jul 30 13:33:11 10.140.24.234 Jul 30 13:33:11 Access_Logs_Splunk: Info: 1564511588.080 44 10.140.4.104 TCP_MISS/200 35005 GET http://ts.intra.dol.ks.gov/Files/PDF/EmployeeRecognition.pdf "DOL\njanco@KDOL_Web_Auth" DIRECT/ts.intra.dol.ks.gov application/pdf DEFAULT_CASE_12-Social_Media_Access_Policy-KDOL_Web_Identity-NONE-NONE-NONE-DefaultGroup <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",6364.55,0,-,"-","-",-,"-",-,-,"-","-",-,-,"-"> - ... View more

Re: How to parse and extract OU data

by in Splunk Search
‎07-01-2019 10:47 AM
‎07-01-2019 10:47 AM
I should have provided more data in my original post. Here are examples of the the entire distinguishedName field data: CN=KDORSC22PHRR2,OU=Desktops,OU=Taxation,OU=Scott Building,OU=Workstations,DC=kdor,DC=ks,DC=gov CN=KDORKC9RJFMN2,OU=Booth PC's,OU=Kansas City,OU=Workstations,DC=kdor,DC=ks,DC=gov CN=RV20013743,OU=Laptops,OU=Legal,OU=Mills Building,OU=Workstations,DC=kdor,DC=ks,DC=gov ... View more

Re: How to parse and extract OU data

by in Splunk Search
‎07-01-2019 10:43 AM
‎07-01-2019 10:43 AM
When trying the second string, received the following error Error in 'SearchParser': Missing a search command before '^'. Error at position '83' of search query 'search sourcetype=ActiveDirectory operatingSystem=...{snipped} {errorcontext = mmonName>[^\,]+)\,OU=}'. ... View more

Re: How to parse and extract OU data

by in Splunk Search
‎06-28-2019 11:06 AM
‎06-28-2019 11:06 AM
Yes, it's all from one Active Directory log. As for the OS and IP, those are just other values from my search query. They are not part of the the issue. ... View more

How to parse and extract OU data

by in Splunk Search
‎06-28-2019 10:42 AM
‎06-28-2019 10:42 AM
I am trying to parse and extract the field data from AD distinguishedName field using regex, but I'm not having too much luck. Here is what I'm looking at: CN=AVB6F9974,OU=Farley PC's, OU=Kansas City, OU=Workstations,DC=lop,DC=local CN=AVB6F9975,OU=Booth PC's, OU=Scott Building, OU=Workstations,DC=lop,DC=local CN=KBOD6F9975,OU=Booth PC's, OU=Zale Building, OU=Workstations,DC=lop,DC=local The end goal is to create a report that looks like the table below. Workstation Location Operating System IP address AVB6F9974 Kansas City Windows 10 AVB6F9975 Scott Building Windows 10 KBOD6F9975 Zale Building Windows 10 ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎01-13-2021 09:32 AM