convert ctime(timestamp/1000)
aid=* event_simpleName=DnsRequest | regex DomainName=".*\.top$|.*\.club$|.*\.xyz$|.*\.ru$|[0-9]+.*\.\w$" | stats values(ComputerName) count by DomainName| where count <4 | sort – count
| # Conversion of http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#search.2Fjobs.2Fexport | |
| # example using curl, to PowerShell with Invoke-RestMethod cmdlet | |
| # | |
| # $ curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export | |
| # --data-urlencode search="search index=_internal | stats count by sourcetype" | |
| # -d output_mode=json -d earliest="rt-5m" -d latest="rt" | |
| $cred = Get-Credential | |
| # This will allow for self-signed SSL certs to work |
| #!/usr/bin/env python3 | |
| """ | |
| 2025 update: | |
| - Recursive extraction from nested EML files | |
| - Robust filename handling with sanitization and deduplication | |
| - Proper logging instead of print statements | |
| - Enhanced error handling and validation | |
| - Binary file reading for better encoding support | |
| - Cross-platform filename compatibility |