GABRIEL VASSEUR

Day 4 is here . Part 1 Let's start with the example data: For each position, we need to count the number of neighbours. That's ok for left and right neighbours, but for the ones above and below, we need the previous and next row. That means using streamstats with current=f! But we need to use it twice now: It kind of works, but you can see we have two problems: we have a useless record at the top. We can simply add | search row=* we're missing one at the bottom. All we need f

Windows events are a large part of the volume of logs ingested in a lot of splunk deployments. Wouldn't be cool if we could shrink them so they don't eat up so much precious precious license? In this post I'll walk through how I rebuilt Windows Event Logs (WELs) into a compact, Splunk-friendly format, cuting size by up to 60% without breaking field extractions. Key takeaways With a few targeted ingest actions and props/transforms tweaks, you can shrink Windows logs dramatical

The key thing I did not appreciate when I wrote the previous version of this post is that the Risk data model is now fed from...