Скачать или смотреть Splunk Tutorial | Save Results to a CSV

Playlist Link for All Daily Trainings
   • "Learn SPL by Example: Hands-On Guide to S...  

Log Analysis Made Easy (L.A.M.E.) Free Analytic Daily Share (F.A.D.S) will help you navigate Splunk better, use data models, or search for something from popular Splunk logs. Please feel free to comment below for analytics that you may be interested in seeing.

This analytic will output the results of a query to a csv that can be used in searches at a later time.

index=corelight sourcetype=corelight_conn
| fields src_ip, dest_ip ``` Ignore all of the other fields not necessary ```
| eval ip=mvappend(src_ip, dest_ip) ``` make src_ip and dest_ip into a multivalue field ```
| fields - src_ip, dest_ip ``` remove the now duplicative src and dest addresses ```
| mvexpand ip ``` separate the ip field so it is no longer a multivalue field ```
| stats count by ip ``` remove all duplicative ip addresses ```
| lookup lame_subnets ip as ip output location
| search location="internal" OR location="dmz"
| outputlookup myInventory.csv

Join this channel to get access to early release of videos and exclusive training videos that will help make you L.A.M.E. ninja:    / @lamecreations_guides  

To view all videos in the playlist on Splunk Tutorials for Creating Searches use the link:
   • "Learn SPL by Example: Hands-On Guide to S...