Nifty Splunk Tips
Just some Splunk Tips and tricks I've found super helpful to have on hand.
Concatenate field1 and 2 as a new field named test.
• | eval test=field1.field2
• | eval test=field1. "optional static text to concatenate" .field2
Using regex to strip the file extension from a URL. Can use this to search for suspicious file types like xap and swf.
• index=au_proxy | rex field=url "\/[\(\)a-zA-Z0-9_-]*?\.(?<ext>[a-z0-9]{2,5})(\?|$)" | search ext=*
Perform a DNS lookup on input domain and output as domainIP.
• | lookup dnslookup clienthost as inputdomain OUTPUT clientip as domainIP
Check the raw events
• | table _raw, source
Ultra Toolbox thingy for parsing subdomain, extensions and filenames from URLs
• | eval list="mozilla" | `ut_parse_extended(url,list)` |
Sexy time formatting
• eval c_time=strftime(_time,"%m/%d/%y%H:%M:%S")
Use the results of one search and pipe it to another
• index=wineventlog EventCode=4624
[search index=firewall dest_port=3389 dest_category=domain_controller src_category!=known_scanner
| table src]
| stats values(user) count by src
Join stuff together
• index=firewall dest_port=3389 src_category!="known_scanner" dest_category="domain_controller"
| table src dest_port dest Users
| join type=left src
[search index=wineventlog_sec user!="*$" | stats values(user) AS Users count by src]
| table src dest_port dest Users
| dedup src,dest,Users
Where all the indexes at
• | tstats count where index=* by index
Include or exclude stuff in a csv
• NOT [| inputlookup exclusions.csv | fields Web.dest, Web.category, Web.url]
Quick bytes to MB
• | eval TransferredMB=round((TransferredBytes/1024/1024),3)
Using IN to save time, money, space, and sanity
• Your search here … AND NOT (All_Traffic.dest_port IN (0,7,20,21,22,23,25,53,80,110,123,135,137,139,143,389,443,445,853,993,995,1433,3478,3481,5060,5061,8080,8081,8801,8888,9025))
Append results from different sources
• index=proxy dest="*https://t.co/ERSKjAyW0n"
| append [search index=firewall subtype=DNS qname="*https://t.co/ERSKjAyW0n" | rename qname AS dest]
| table _time src_ip dest dest_ip action status user transport http_method url useragent filetype threatname refererURL urlclass urlsupercategory urlcategory pagerisk
