วีดีโอ

Ok I will be waiting for it

You offering splunk class?

Thanks Amigo, question, Stellar Cyber questions exams are differents to the Stellar Cyber questions? I am litle confuse cause you start the video mentioning Splunk. Regards

docs.splunk.com/Documentation/Splunk/9.3.1/Security/SecuringSplunkEnterprisewithFIPs docs.splunk.com/Documentation/Splunk/9.3.1/ReleaseNotes/SplunkandTHP

clearly explained

Thanks

Thank you

Great content 👏👏❤️

Sekar, please cover data onboarding concepts

Nice one sekar We are not seeing any videos related ITSI in you tube

Hi Sekar, Thanks for the videos and efforts.

Good to know. Thank 👍

test

Super massu

Thank you Mass Boss

problem statement: --------------------- I'm trying to corral a string into new field and value and having trouble. I've used eval / split / mvexpand.... The string looks like this. Its actually a field in an event: field_id=/key1/value1/key2/value2/key3/value3/key4/value4 The end goal is to have new fields. Like: field_key1=value1 filed_key2=value2 So i can now search, for example, if field_key1='the value of something" --------------------- Split command ------------------------ | makeresults | eval field_id="/key1/value1/key2/value2/key3/value3/key4/value4" | eval temp=split(field_id,"/") | eval field_key1=mvindex(temp,2) | eval field_key2=mvindex(temp,4) | table field_id field_key1 field_key2 rex, foreach ------------------- | makeresults | eval field_id="/key1/value1/key2/value2/key3/value3/key4/value4" | rex field=field_id max_match=0 "/(?<k>[^/]*)/(?<v>[^/]*)" | foreach 0 1 2 3 4 5 6 7 8 9 10[ eval _k=mvindex(k, <<FIELD>>), {_k}=mvindex(v, <<FIELD>>) ] rex, streamstats ---------------------------- | makeresults | eval field_id="/key1/value1/key2/value2/key3/value3/key4/value4" | rex field=field_id max_match=0 "/(?<key>[^/]+)/(?<value>[^/]+)" | eval row=mvrange(0,mvcount(key)) | streamstats count as _row | mvexpand row | eval name="field_".mvindex(key,row) | eval {name}=mvindex(value,row) | fields - key value name row | stats values(*) as * by _row

*promosm*

how many attempts are given for the SCCA exam? I heard that only 2 attempts are given.

These questions are extremely basic nobody asks them anymore especially if you have over 4+ years of experience.

"Promosm"

Nice mass boss

github.com/inventsekar/Splunking-Thirukkural/blob/main/Splunk-Learning-Path-July-2023.jpg

$SPLUNK_DB is generally ..... $SPLUNK_HOME/var/lib/splunk .... /opt/splunk/var/lib/splunk (unix) ..... %SPLUNK_HOME%\var\lib\splunk ..... c:\Program Files\Splunk\var\lib\splunk (windows>) $ $SPLUNK_HOME is generally /opt/splunk keywords to remember/learn: maxHotBuckets maxHotSpanSecs maxDataSize maxWarmDBCount frozenTimePeriodInSecs For your info.. yzsam.com/html/GRhauU.html community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platform-the-Masa/m-p/590774

Nice project 👌

good explanation bro

🤦 "promosm"

Hi Splunkers... hru all doing... Welcome to this Splunk Rex 101 series...part 1..."word charactor matching command(\w and \w+)" --------------------------------------------------------------------------- lets assume our test log as: log="Splunk Rex101...word charector, digit charactor and space charactor matching... w and w+, d and d+, s and s+...lets learn" --------------------------------------------------------------------------- Splunk search query for splunk command \w: -------------------------------------------- | makeresults | eval log="Splunk Rex101...word charector, digit charactor and space charactor matching... w and w+, d and d+, s and s+...lets learn" | rex field=log "(?P<wordChar>\w)" | table log wordChar Quiz Splunk search query for splunk command \w+: ------------------------------------------------- | makeresults | eval log="Splunk Rex101...word charector, digit charactor and space charactor matching... w and w+, d and d+, s and s+...lets learn" | rex field=log "(?P<wordChar>\w)...(?P<wordCharOneorMore>\w+)" | table log wordChar wordCharOneorMore hope this is clear.. Please give it a thought about the quiz for \w+, we will see answer in the next video. let me know if any questions,.. thanks. catch you later!

promo sm

| makeresults |eval log="testlognon-word non-digit matching $ % & * 1 2 3 ewrewrewe" | rex max_match=0 field=log "(?P<quantifier>\d+)" | table log quantifier

| makeresults |eval log="test log... non-word non-digit matching.. $ % & * 1 2 3 ewrewrewe" | rex max_match=0 field=log "(?P<nonWord>\W)" | mvexpand nonWord | table log nonWord