About rafadvega

rafadvega · ‎05-26-2023

I have found an alternative way using FIELDALIAS. If there is a better way to do it, I appreciate the help: props.conf: [mysourcetype] FIELDALIAS-field2_mv_as_field2= field2_mv AS field2 KV_MODE = None REPORT-extract_key_value = extract_key_value REPORT-extract_mv_fields = field2 SHOULD_LINEMERGE = false transforms.conf [extract_key_value] FORMAT = $1::$2 REGEX = fieldname.([^=]+)=([^\,]+) [field2] SOURCE_KEY = field2 MV_ADD = 1 FORMAT = field2_mv::$1 REGEX = ([^\s]+):

rafadvega · ‎05-25-2023

I have a sourcetype with events like: fieldname.field1=value1,fieldname.field2=value1 value2 value3 value4,fieldname.field3=value1 To extract the fields, I use the following transformation which works correctly: [extract_key_value] FORMAT = $1::$2 REGEX = fieldname.([^=]+)=([^\,]+) The field2, I want to convert it into a multivalue field by splitting it on spaces. If I do the following, it works correctly: [field2] SOURCE_KEY = field2 MV_ADD = 1 FORMAT = field_test::$1 REGEX = ([^\s]+): However, if I try to overwrite the field, it doesn't work. [field2] SOURCE_KEY = field2 MV_ADD = 1 FORMAT = field2::$1 REGEX = ([^\s]+): What could be my mistake? Thank you in advance PD: My props.conf: [mysourcetype] KV_MODE = None REPORT-extract_key_value = extract_key_value REPORT-extract_mv_fields = field2 SHOULD_LINEMERGE = false

rafadvega · ‎11-18-2021

Hi, I would like to count the values of a multivalue field by value. For example: | makeresults | eval values_type=split( "value1,value2,value1,value2,value1,value2,value1,value2,value2,value2,value2,",",") | eval values_count=mvcount(values_type) | eval value1=mvfilter(match(values_type,"value1")) | eval value1_count=mvcount(value1) | eval value2_count=values_count - value1_count | table values_type message_count values_count value1_count value2_count Is there another way to do this? For example, if I don't know the possible values, this way doesn't work. Thanks in advance

rafadvega · ‎11-18-2021

You should use Windows Addon to parse events: Splunk Add-on for Microsoft Windows | Splunkbase Then the search is like: index=wineventlog source=XmlWinEventLog:Security EventCode=4625

rafadvega · ‎11-12-2021

Hi!! try this: your search | streamstats count by host_name | eval host_name=host_name.count | fields - count

rafadvega · ‎11-12-2021

Is it possible that you need is the command head? Something like this: index=myindex sourcetype=mytype field1=* field2=* | stats count(eval(condition1)) as count1 count(eval(condition2)) as count2 by field1 field2 | sort -count1, -count2 | head 100

rafadvega · ‎11-12-2021

I think the only option is to use the api to get the results and create the .xls file. In python, it should be easy. If you have access to the api and want help to develop this, I can make an example.

rafadvega · ‎11-12-2021

Hi! Some DCs works correctly with the same config? In that case, did you test the connectivity? With telnet for example: telnet <splunk.mydomain.com> >listener-port>

rafadvega · ‎11-10-2021

That is a perfect solution. Thank you very much!

rafadvega · ‎11-10-2021

Hi, I need to join two searchs. For example: Example 1: | inputlookup join_example1.csv country product day stock Spain apples 10/10/2022 25 France apples 10/10/2022 22 Spain grapes 10/10/2022 30 France grapes 10/10/2022 28 Spain apples 10/10/2021 25 France apples 10/10/2021 22 Spain grapes 10/10/2021 30 France grapes 10/10/2021 28 Example 2: | inputlookup join_example2.csv day product requested 10/10/2022 apples 90 10/10/2021 apples 110 10/10/2022 grapes 100 10/10/2021 grapes 110 If I join bot searchs: | inputlookup join_example1.csv | join product, day [| inputlookup join_example2.csv] | table product day country stock requested The result is: product day country stock requested apples 10/10/2022 Spain 25 90 apples 10/10/2022 France 22 90 grapes 10/10/2022 Spain 30 100 grapes 10/10/2022 France 28 100 apples 10/10/2021 Spain 25 110 apples 10/10/2021 France 22 110 grapes 10/10/2021 Spain 30 110 grapes 10/10/2021 France 28 110 But I need the sub search merges only with the first result like this (only in one country): product day country stock requested apples 10/10/2022 Spain 25 90 apples 10/10/2022 France 22 0 grapes 10/10/2022 Spain 30 100 grapes 10/10/2022 France 28 0 apples 10/10/2021 Spain 25 110 apples 10/10/2021 France 22 0 grapes 10/10/2021 Spain 30 110 grapes 10/10/2021 France 28 0 That is only a example, I need only merge subsearchs results once. Anyone knows a solution for this? Thanks!!!

rafadvega · ‎11-10-2021

Hi! You can use this command: index="index" search_term | rex field=_raw "LINK_TARGET\s:\s(?<link_target>[^\n]*)\n"

rafadvega · ‎01-31-2020

Thanks for answering. I tried this also: [WinEventLog://Security] disabled=0 index = wineventlog source = XmlWinEventLog:Security sourcetype = XmlWinEventLog ... ... ... whitelist= EventCode="4663" $XmlRegex="(C:\Windows\System32\Taskmgr.exe)" blacklist = 4624,4625,2222 blacklist1 = EventCode="4688" $XmlRegex="(C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe)|(C:\Program Files\SplunkUniversalForwarder\bin\btool.exe)|(C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe)|(C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe)|(C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe)|(C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe)" blacklist2 = EventCode="1111" $XmlRegex="C:\ProgramData\random\andom2\dasdfa.exe" But it isn't work. When I add the whitelist, all security events are filtered...

rafadvega · ‎01-31-2020

Hello, I need to create a whitelist with the blacklist. I mean... I have three blacklist in the windows security input: [WinEventLog://Security] disabled=0 index = wineventlog source = XmlWinEventLog:Security sourcetype = XmlWinEventLog ... ... ... blacklist = 4624,4625,2222 blacklist1 = EventCode="4688" $XmlRegex="<Data Name='NewProcessName'>(C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe)|(C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe)|(C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe)|(C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe)|(C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe)|(C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe)</Data>" blacklist2 = EventCode="1111" $XmlRegex="<Data Name='CallerProcessName'>C:\\ProgramData\\random\\andom2\\dasdfa.exe</Data>" I need to add another blacklist like this: blacklist3 = EventCode="4663" $XmlRegex="<Data Name='ProcessName'>(C:\\Windows\\System32\\Taskmgr.exe)</Data>" This blacklist remove all 4663 events with the processname Taskmgr.exe (works). But actually, I want to remove all 4663 events except, 4663 events with the process name Taskmgr.exe I tried to use an expression like this, but it isn't work: blacklist3 = EventCode="4663" $XmlRegex="<Data Name='ProcessName'>(?!C:\\Windows\\System32\\Taskmgr.exe)</Data>" blacklist3 = EventCode="4663" $XmlRegex="<Data Name='ProcessName'>?!(C:\\Windows\\System32\\Taskmgr.exe)</Data>" blacklist3 = EventCode="4663" $XmlRegex="<Data Name='ProcessName'>^((?!C:\\Windows\\System32\\Taskmgr.exe)[\s\S])*$</Data>" Has it a solution? I can't use a whitelist because I have blacklists. Thanks a lot!

rafadvega · ‎11-13-2019

try this: Example raw log: type=USER_TTY msg=audit(1573643958.798:1973): pid=2964 uid=0 auid=1000 ses=22 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 data=636174202F7661722F6C6F672F61756469742F61756469742E6C6F67207C206772657020555345525F545459UID="root" AUID="rdevega" splunk code: your search here | eval keystrokes = urldecode(replace(data,"([0-9A-F]{2})","%\1")) | table data keystrokes results:

rafadvega · ‎09-16-2019

works! you are f...king monster. Thanks!!

rafadvega · ‎09-16-2019

Yo can try this: | rex field=<yourfield> ("(Deployment of Application|Deployment of)\s(?<Application>.*)\swith version.*")

rafadvega · ‎09-16-2019

I had the next events examples: 2019-09-16T13:27:10.169107+02:00 koopa.browser.local node= koopa.browser.local type=EXECVE msg=audit(15687332450.174:771277): argc=2 a0="cat" a1="/proc/cmdline" 2019-09-16T13:27:10.169107+02:00 koopa.browser.local node= koopa.browser.local type=EXECVE msg=audit(15687123450.174:123277): argc=3 a0="/bin/systemctl" a1="status" a2="ntpd.service" I need to concatenate de fields a0, a1, a2, a3... etc, but it isn't a fixed number of fields. Can I concatenate a variable number of fields defined by argc field? Thanks!!

Posts	17
Solutions	3
Karma Given	3
Karma Received	4
Member Since	‎07-16-2019

Online Status	Offline
Date Last Visited	‎05-26-2023 10:04 AM

How to override field with transforms.conf?

mvcount by value

join only with the first row

Inputs.conf blacklist with a negative regex

How to concatenate a variable number of fields?

Re: override field with transforms.conf

How to override field with transforms.conf?

mvcount by value

Re: REQUEST FOR ACCOUNT LOCOUT AND LOGON FAILURE S...

Re: Count per host

Re: How to use the result of top command to a stat...

Re: How to create a report in Excel format ( .xls)

Re: wineventlog:security logs not receiving

Re: join only with the first row

join only with the first row

Re: Field Extraction

Re: Inputs.conf blacklist with a negative regex

Inputs.conf blacklist with a negative regex

Re: Convert audit.log TTY data

Re: How to concatenate a variable number of field...

Re: Dynamic trim of field at both start and end

How to concatenate a variable number of fields?