About hok2010

hok2010 · ‎11-03-2020

im facing the same problem, no NSG changes was done in any recent. only problem is workload "azureactivedirectory" is not reporting and rest workloads are pulling results perfectly fine.

hok2010 · ‎11-22-2019

Hello Guys, I'm stuck with integrating Obelisk threat feed to my test environment. installed TA add on indexer installed obelisk threat feed on search head Always I get a message in index=obelisk [*] Starting python threat list script. [*] Looking for old log files to clear. I checked whether input files are updated \obelisk-threat-intel\lookups but no luck its 0 kb No files in log folder also [\TA_obelisk-threat\logs].

hok2010 · ‎08-03-2019

hi arjun, it didnt work well im getting the same results

hok2010 · ‎08-03-2019

hi arjun, only map command take query in qoutes, here eval is assigning the your query as string on the field "basesearch" one alternative you can try is to create a marco for your query in setting>advanced search > add new macro then you can call it with basesearch

hok2010 · ‎08-03-2019

Hello All, i need a help in creating report i have a mv field called "report", i want to search for values so they return me the result. i tried with "IN function" , but it is returning me any values inside the function. to be particular i need those values in mv field for example, i have two fields manager and report, report having mv fields manger------------------------ report john ------------------ day1 ------------------ day2 ------------------ day3 ------------------ day4 kevin -------------- day1 ------------------ day4 index="my search" | where in(report,"day1","day4") so here i'm expecting only results for kevin i dont want to mv index it into multiple fields!

hok2010 · ‎04-29-2019

it seems like your host is not in the blah index, make sure the host resides in right index try search: index=* host=somehost

hok2010 · ‎01-19-2019

Hi Girish, please try this one this is for windowsevent logs ----SPL Query----- sourcetype="wineventlog:security" EventCode=4625 | eval Account_Name=mvindex(Account_Name,1) | stats values(ComputerName) as Servers_failing by Account_Name | where mvcount(Servers_failing)>1

hok2010 · ‎01-19-2019

hi guys i wanted to search for a list of failed login attempts by privileged users from existing successful logons (EventCode=4672). I tied to do a subsearch but resulting in a false positive Other non-privilleged users also comes in to my result. index=main sourcetype="wineventlog:security" EventCode=4625 | eval Account_Name=mvindex(Account_Name,1) | search Account_Name!=$ | append [ search index=main sourcetype="wineventlog:security" EventCode=4672 Account_Name!=$ | table Account_Name] | table _time EventCode Account_Name

hok2010 · ‎10-17-2018

Hi! temp=C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe to... path=C:\Program Files\SplunkUniversalForwarder\bin process=splunk-powershell.exe this is what I reach... I'm stuck at the regex. Any other method is also appreciated | rex field=temp "(?[^\\\/]*)$" |regex path=!temp |table FILENAME,PATH

Posts	9
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-22-2018

Online Status	Offline
Date Last Visited	‎12-13-2020 01:48 PM

Obelisk Threat Intel: Feed no data

search values inside MV

subsearch for failed login

Can anyone help me split this field into 2?

Re: Azure Active Directory Stops

Obelisk Threat Intel: Feed no data

Re: search values inside MV

Re: What is wrong with this "map" command search?

search values inside MV

Re: Host field without wildcards returns no result...

Re: how to set an alert for user failed to login t...

subsearch for failed login

Can anyone help me split this field into 2?