Sometimes when working with fields in SPL, it can be useful to search for and replace parts of text found in the field. Some reasons for doing this might be:– removing white space to reduce the size of the field– replacing field separators with characters that look nicer– rearranging values in a field in an […]
The rare command in Splunk helps you find the least common values in a specific field of your data. This is useful for spotting unusual or infrequent events. By default, the rare command in Splunk returns the 10 least common values for a specified field. Find Rare User Agents To identify the least common user agents in your web […]
The Splunk coalesce function returns the first non-null value among its arguments. It’s useful for normalizing data from different sources with varying field names. For example, to unify multiple source IP fields into a single src_ip field:
The map command in Splunk is a powerful tool that enables executing secondary searches based on the results of a primary search. This capability allows for dynamic, nested investigations, making it particularly useful in cybersecurity for uncovering indicators of compromise (IOCs) or analyzing specific user activity patterns. Example of using – we can make the […]
In some scenarios, you may need to save the results of a search into another index—for example, to reuse the data for correlation or trend analysis. The collect command in Splunk allows you to write search results into a summary index for long-term storage or faster analysis. Example: Aggregate Failed Login Attempts Suppose you want […]
Step 1:Write a Query to Monitor Multiple Sources Identify the log sources you want to monitor. Create a Splunk search query that checks for events from those sources within a specific timeframe. Example query: Query without additional fields Query with additional fields “message” For example, on the screenshot, I set two hosts to monitor and […]
When possible, use datamodels, they are generally your best bet for speed. However, not everything in your Splunk will be in a datamodel, and you may require a good-old-fashioned index based search. This may come as a surprise, as it is counter intuitive but often using a token in an index based search will absolutely […]
Within splunk we use “stats” and “tstats” a bunch as threat hunters. However, these useful operations can cause interesting events to be dropped unexpectedly. For instance: index=windows sourcetype=*winevent* AND EventCode=4688 AND NewProcessName=*Evil.exe| stats count by ComputerName, ParentProcessName, NewProcessName, CommandLine CommandLine is a field in 4688 events that needs to be enabled via “group policy”. So, […]
When you find yourself constantly reusing certain strings of Splunk commands, it can be a lot easier to represent those commands as a single line of code that can accept positional arguments and serve the same functions as a set of commands you find yourself using often. This is the purpose of a Splunk macro […]
Sometimes when working with new log sources or unfamiliar event records being shipped to Splunk, you’ll encounter logs with important details that could be more useful if you had them captured in a field. The entirety of the text in an event can be found in the _raw field but specific details found in the […]