About keyu921

keyu921 · ‎05-10-2021

Resolved

keyu921 · ‎09-19-2020

Current report for the following event log index=windows EventType=4 host=* | table _time host EventCode Message /// EventType=4 Type=Information ComputerName=NOYO.asus.com Message=Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.323.1450.0) // I try to filter away if event if message contains Security Intelligence Update for Microsoft Defender Antivirus index=windows EventType=4 host=* | where Message="%Security Intelligence Update for Microsoft Defender Antivirus%" | table _time host EventCode Message But seems message cannot filter

keyu921 · ‎08-27-2020

I prepared csv to inputlookup to compare the Splunk logs. adhoc.csv // Account, test01,etc.... test02,etc.... // my Query index=msad sourcetype=msad [| inputlookup adhoc.csv | fields Account] Searching Period: Last 24 hours Cross check adhoc.csv match the searching logs. For those account did not perform any authentation which logs stored at index=msad, during search period, then show zero values.

keyu921 · ‎06-18-2020

I want to extract the client ip and user "DELTA\Kelly" from the windows event messages Message=The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a cleartext (non-SSL/TLS-encrypted) LDAP connection. Client IP address: 172.4.5.6:57157 Identity the client attempted to authenticate as: DELTA\Kelly Binding Type: Fixed..... Please close

keyu921 · ‎06-14-2020

Solved

keyu921 · ‎05-27-2020

bar chart that no.active and trend grow for last1yrs timechart span=1month

keyu921 · ‎05-27-2020

keyu921 · ‎05-26-2020

thank you i got the diagram expected after modify some query

keyu921 · ‎05-26-2020

After I review the data, I got 30 license type, I want to keep 365E1 and 365E2 for adopted and others are non-adopted How can I eval like? | eval kind=if(license!="%OFFICE 365%","non adopted","adopted") | chart dc("email") OVER kind BY country

keyu921 · ‎05-25-2020

I have following data email|country|license aa|HK|365E1 bb|US|365E2 cc|HK|non-office dd|HK|non-office ee|UK|non-office I would like to got bar chart that values of adopted (365E1+365E2) and non-adopted and count by country base_search | chart dc("email") AS Count over country by license

keyu921 · ‎05-25-2020

thanks seems i mix up inputlookup and lookup

keyu921 · ‎05-25-2020

index=* sourcetype=csv |search [|inputlookup testing| return 1000 $host] | stats last(Size) last(Used) last(Use) by host

keyu921 · ‎05-25-2020

I setup testing.csv lookup as following host,location 123,HK 234,US 345,UK I would like to basic search if host matched in the log, stats count by location index=log sourcetype=csv |search [|inputlookup testing | return $host] | stats .... by location But seems return nothings

keyu921 · ‎05-21-2020

it is ok now

keyu921 · ‎05-21-2020

same result

keyu921 · ‎05-20-2020

|rex Message=(?ms)Message=\"(?.+)\s+SID But seems failed

keyu921 · ‎05-20-2020

Message="Internal event: Function ldap_search entered. SID: S-1-5-18 Source IP: 127.0.0.1:25855 Operation identifier: 680571 Data1: Data2: 2796807187 Data3: Data4:" How can I just left message "Message="Internal event: Function ldap_search entered." by rex to define as fields or use eval command?

keyu921 · ‎05-19-2020

Thanks it works

keyu921 · ‎05-19-2020

I search the syntax and find Account_Domain result contains two column. How can I result first column so that I left ALPHA?? ALPHA

keyu921 · ‎05-14-2020

My Data as following AA || Disabled || Region 11@abc.com || Yes || HK 12@abc.com || No || US 13@abc.com || No || US 14@abc.com || No || UK 15@abc.com || Yes || UK 16@abc.com || No || UK 17@abc.com || No || UK 18@abc.com || No || HK 19@abc.com || Yes || HK I would like to count as following % of account disable and enable in different region | stats count(eval(status=="No")) as var1 by CountryRegion, count(eval(status=="Yes")) as var2 by CountryRegion ???

keyu921 · ‎05-13-2020

Become like this Account_Domain ALPHA ALPHA

keyu921 · ‎05-12-2020

I am searching windows event log. Aftre result search complete, Account_Domain contains following value "- ABC" How can I left ABC inside?? | rex field="Account_Domain" mode=sed "s/([0-9]{4}) /\1,,/" not working

keyu921 · ‎05-12-2020

I want to perform calc on following Number of disable account Region Disable Acc HK Yes AA HK No BA US No AA UK No DA eval(if region="*") stat count?

Posts	23
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎05-11-2020

Online Status	Offline
Date Last Visited	‎05-10-2021 06:12 AM

Splunk searching Syntax

Filter away pattern on windows event log report

CSV Lookup for search query

Field extract

Splunk logging issues

Accum statement

count problem

inputlookup csv

eval or rex help

Remove extra fields

Splunk searching Syntax

Filter away pattern on windows event log report

CSV Lookup for search query

Field extract

Splunk logging issues

Re: Accum statement

Accum statement

Re: count problem

Re: count problem

count problem

Re: inputlookup csv

Re: inputlookup csv

inputlookup csv

Re: eval or rex help

Re: eval or rex help

Re: eval or rex help

eval or rex help

Re: Remove extra fields

Remove extra fields

How can I count which different lines

Re: Double value in field

Double value in field

Calc field