Joseph Plunkett
- Total activity 16
- Last activity
- Member since
- Following 0 users
- Followed by 1 user
- Votes 1
- Subscriptions 5
Activity overview
Latest activity by Joseph Plunkett-
Joseph Plunkett commented,
Shanmukhanand Naikwade | _sourceCategory=<srcCat> | count dst_ip, dst_port| now() as _messagetime| transactionize dst_ip (merge dst_ip takeFirst, dst_port join with ", ") | fields - _messagetime ...
-
Joseph Plunkett commented,
Shanmukhanand Naikwade Ahh yeah I see what you're saying. You need to do a count before the transactionize to dedup the ports. It is possible I do have this working, it just isn't clean.
-
Joseph Plunkett commented,
Shanmukhanand Naikwade Yes, in order to remove duplicates you can do a couple things. First, you can 'count' the ports before the transactionize OR you can use the 'takeFirst' param in the transact...
-
Joseph Plunkett commented,
I got this figured out and I'll post the answer here in case it helps someone else. _sourceCategory=<YourSrcCategoryHere>| count dst_ip, dst_port // this dedupes the values| now() as _messageti...
-
Joseph Plunkett created a post,
Merge Multiple Values into a Single Field
Hello, I am looking for a way to merge several values into one field (or cell) in order to reduce the clutter in a table view. For example, when parsing my Firewall logs I want to be able to pa...
-
Joseph Plunkett commented,
Are your logs always in this format? If so it would probably be better to use the 'parse anchor' method.
-
Joseph Plunkett created a post,
Field Extraction Rule Only Works if Receipt Time Checked
Hello, I have created a FER for my proxy but for some reason it is not working right. If I click the "Use Receipt Time" checkbox then I can see all my fields from the rule. If I do not click ...
-
Joseph Plunkett commented,
Hey Ryan, Sorry for the late response, I never got notified that you responded to the thread. I ended up figuring it out doing what you did, but thanks for the help!
-
Joseph Plunkett commented,
| where (hour > 18 or hour < 6) :)
-
Joseph Plunkett created a post,
Urlencode for special characters
Hello, I am trying to use the urlencode() + concat() functions to create a linked search. The link will display in a dashboard and open the search in a new window. For the most part I have this wo...