I got a variable called _host_name which = usscic-secfio102.na.xxx.com.  I need to derive a variable called host_short which will have the value of usscic-secfio102   -- I use Ruby Regular expression editor to figure out expression to get string i need -- it's    ^\w+.\w+     How do I integrate in querty using rex?   index=cisco sourcetype=cisco_asa AND vendor_action=permitted AND host=158.11.333.444 | eval service=transport."/".dest_port| lookup dnslookup ip as host output host as host_name| rex????? | table host_short ... View more

Need some help ...  I looked at several examples but not that straight forward ...  The rex and split functions were my best bet ... never got anything ... that really worked well. The split function only gave me the first part.  The rex function did not get me a variable assignment. I need to be able to get a variable -- preferably through the eval function that captures the sid # in a variable like mySid.   See the sample string below.  I just need the # which in the example below which is 2008518.  The Sid # is going to be in the text string in different locations- i.e not the same exact absolute location in the string.  Appreciate the help!!! 🙂 Example - String    A suspicious packet was sent [sid:2008518] -- Detected an attempt to make a configuration change in SQL DB using the legit 'sp_configure' command The xp_cmdshell option is a SQL Server server configuration option that enables system administrators to control whether the xp_cmdshell extended stored procedure can be executed on a system. By default, the xp_cmdshell option is disabled on new installations. Before enabling this option, it is important to consider the potential security implications associated with the use of this option. It is proposed to disable the xp_cmdhsell option.   ... View more

Tried  a couple of functions ... nothing easy... Example (index=XXX) AND event="XXXXXX" | eval tim =strftime(_time,"%m/%d/%Y") | eventstats max(tim) as maxDate| stats count by dvchost, maxDate I need to figure out how to find the most recent records....  code does not work... looked at other ways to do it .... nothing easy... help   ... View more