Hello, I have the following type of event, and I would like to extract the `tags` field into its respective fields.    2022-10-17 06:50:00.997, root_device_name="/dev/sda1", root_device_type="ebs", state_name="running", subnet_id="subnet-REDACTED", tags="{"App": "myapp", "Name": "myserver", "Owner": "myteam", "Scope": "myscope", "AWSBackup": "True", "Environment": "myenv", "Compliance requirement": "N/A"}", virtualization_type="hvm", vpc_id="vpc-REDACTED"   I have tried the following which did not work for me:    index=myindex sourcetype=mysourcetype earliest=@d i-REDACTED source=awsec2instances | spath input=tags   How do I extract these JSON fields from an event like this?  ... View more

Hi friends, I am trying to piece together some splunk searches across application logs to try and piece together what 'normal' traffic patterns look like, vs DDoS attacking IP addresses. The end goal is to answer the question: "For each IP that connects to our application, what is the average connection count within a 5m span, across a 2 hour period? What are the outlier ( greater than average) 5m span connection counts?  I have the following timechart which has been useful, but I'm sure there is a better way to do this.    index=myapplicationindex sourcetype=_json cluster=cluster23 | timechart span=5m count by x_forwarded_for where count > 75     ... View more

index=myindex  | eval createdepoch = strptime(created, "%Y-%m-%d") | eval _time = createdepoch | search earliest=-90d@d  | table _time This returns no results,  Can anyone tell me why this wouldn't work?   ... View more

Hi everyone, I've tried two different apps to do this, and I'm stuck.  Goal: Send a private message to a slack user via an inline command so that I can pipe `| map` to the inline command to populate the recipient/message.  I have tried two different apps now and neither are doing what I need. https://splunkbase.splunk.com/app/2878/#/details : this one requires an 'incoming webhook' which is statically set to a channel. Overriding it with | sendalert slack param.channel="@myOverrideUserToSendTo" param.message="test"  doesn't seem to work. https://splunkbase.splunk.com/app/3900/ : this one would work, however you cannot trigger it with an inline command, which I need in order to do my use case. If there is a way to do an inline `|sendalert`alert with this, I am unaware how to do this.  ... View more

Hello, I've gone through a hundred of these types of posts and nothing is working for me. Here is the nested json array that I would like to split into a table of individual events, based on the computer.hardware.storage.device.partition{} and computer.general.name . Once I have these split into individual events, I would like to only put the 'boot' device event in the table. { "computer": { "general": { "name": "woohoo-l3" }, "hardware": { "storage": { "device": { "partition": [ { "name": "Macintosh HD (Boot Partition)", "type": "boot", "filevault_status": "Encrypted", "filevault_percent": "100", }, { "name": "Recovery", "type": "other", "filevault_status": "Not Encrypted", "filevault_percent": "0", } ] } } } } } I have come up with the following search but it does not do what I want. I've been messing with this all day and I'm stuck. Any help would be greatly appreciated! index=sec-inventory sourcetype="jamf-computers" "c02z912nlvdl" | spath | rename computer.hardware.storage.device{}.partition.filevault_status as filevault_status | rename computer.hardware.storage.device.partition{}.type as partitiontype | rename computer.general.name as computername | eval zipped=mvzip(filevault_status, partitiontype) | mvexpand zipped | eval zipped=split(zipped, ",") | eval filevault_status=mvindex(zipped, 0) | eval type=mvindex(zipped, 1) | fillnull value="null" | table computername, partitiontype, filevault_status | search partitiontype="boot" The table should look like ... View more

I have two datasets in separate indexes that I would like to compare. i.e. dataset from search1 : item1 item2 item3 dataset from search2 : item1 item2 item3 item4 item5 I would like to produce a table that gives me a table of items that exist in search2 and not in search1 . i.e. itemfield searchname` ------------------------------------- item4 search2 item5 search2 How would I do this? ... View more

index="myindex" cluster="mycluster" http_request="/" | bucket _time span=5m | timechart count by x_forwarded_for useother=false span=5m the time buckets i'm seeing on this |timechart are half hour buckets instead of 5m buckets. What am I doing wrong? ... View more