如何使用Splunk CIM数据模型
我正在尝试了解如何在Splunk中编写评估语句，并且文档并没有帮助。具体来说，我正在查看恶意软件CIM数据模型，有一个名为“ Malware_attacks”的字段，其规定的值：关键，高，中和低。如何使用此CIM字段和规定的值创建一个评估语句，并将其应用于我在捕获组中分别创建的正则评分？
谢谢 杰克
一世尝试了Splunk CIM数据模型文档，它没有详细介绍规定的值以及如何应用有关如何将其整合到编写eval语句中的CIM数据字段
I am trying to understand how to write an Eval statement in Splunk and the documentation isn't helpful. Specifically, I am looking at the Malware CIM Data Model there is a field called "Malware_Attacks" with prescribed values of: critical, high, medium and low. How do I create an eval statement using this CIM Field and the prescribed values and apply it into my regex I created separately in capture groups?
Thanks
Jack
I have tried the Splunk CIM Data Model documentation and it doesn't go into detail on prescribed values and how to apply the CIM Data Field in question on how to incorporate it into writing an eval statement
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
严重性字段已经存在于Datamodel（DM）中，因此您要做的就是参考它。通过指定DM名称和由DOT隔开的字段来执行此操作。例如，
|表“ malware_attacks.severity”。引号用于防止splunk将其视为两个串联字段（因为。也是求和操作员）。您可以使用重命名删除DM名称，从而使生活更加轻松，以便可以直接引用字段。The severity field already exists in the datamodel (DM) so all you have to do is reference it. Do that by specifying the DM name and the field separated by a dot. For example,
| table "Malware_Attacks.severity". Quotes are used to keep Splunk from treating this as two concatenated fields (since.is also the concatention operator). You can make life a little easier by usingrenameto remove the DM name so fields can be referenced directly.