convert ctime(timestamp/1000)
aid=* event_simpleName=DnsRequest | regex DomainName=".*\.top$|.*\.club$|.*\.xyz$|.*\.ru$|[0-9]+.*\.\w$" | stats values(ComputerName) count by DomainName| where count <4 | sort – count
| # Conversion of http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#search.2Fjobs.2Fexport | |
| # example using curl, to PowerShell with Invoke-RestMethod cmdlet | |
| # | |
| # $ curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export | |
| # --data-urlencode search="search index=_internal | stats count by sourcetype" | |
| # -d output_mode=json -d earliest="rt-5m" -d latest="rt" | |
| $cred = Get-Credential | |
| # This will allow for self-signed SSL certs to work |
| #!/usr/bin/env python | |
| """ | |
| 2020 update: | |
| - More iterators, fewer lists | |
| - Python 3 compatible | |
| - Processes files in parallel | |
| (one thread per CPU, but that's not really how it works) | |
| """ |