### Humio Log Entry with Parsed Fields Example

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-60fe2343-77ce-483b-b7ff-c43bd30e674c

This snippet represents a log entry where various fields have been parsed and extracted. It includes information such as timestamps, agent versions, device identifiers, and policy details, presented in a flattened structure.

```log
5-03-13:17:30:38 +0200| lift_containment_pending| Lenovo| ThinkPad X1 Carbon
c87e08c4f61b5d6352363d8a226a89f7| 0| Z| 8| 2025-03-13:11:45:52 -0400| 6.43.15620.0| American Megatrends| Version 1.0| 19041| e5f6g7h8i9j0k1l2m3n4| 65994757| 12349| 4| 263988| DEV-3e4f5a6b| false| 2025-03-14:01:15:39 +1000| 2025-03-13:08:50:28 -0700| a03aa7587d10408ca79417beda3a1265| device-control| false| 2025-03-13:07:15:48 -0800| 2025-03-13:20:50:35 +0500| 4e6c1aac08e64fba9dda17021db5a186| firewall| 7h9f4ddf31h97ijed2gg30h54ge8d419| true| 2025-03-13:12:45:56 -0300| 2025-03-13:22:30:47 +0700| 5f7d2bbd19f75ghcb0ee18f32ec6b297| globalconfig| 7g9ie5hc| false| 2025-03-14:02:45:37 +1100| 2025-03-13:21:30:25 +0600| 34c2eda9f67446daa84d28fd239635e8| prevention| 5e7gc3fa| false| 2025-03-13:10:35:23 -0500| 2025-03-13:17:20:14 +0200| 6g8e3cce20g86hidc1ff29g43fd7c308| remote-response| 8haif6id| true| 2025-03-13:19:35:12 +0400| 2025-03-13:16:20:49 +0100| 6g8e3cce20g86hidc1ff29g43fd7c308| sensor-update| 6f8hd4gb| DISABLED| 192.168.1.178| 2025-03-13:22:20:17 +0700| i7f4g88632jg5g583ejij8g230jif36861ei85i0083f378ge839335f1296f299| PROD-SQL01| 2025-03-13:15:35:29 +0000| 192.168.4.92| AC:DE:48:23:45:67| bad-actor-infra.io| 4| 16663| 4| 2025-03-14:00:30:57 +0900| 19042| Windows Server 2022| 4| Mac| 4| true| 2025-03-13:09:15:18 -0600| 2025-03-13:18:50:43 +0300| 7h9f4ddf31h97ijed2gg30h54ge8d419| sensor-update| 4d6fb2e9| 2| Server| NotProvisioned| yes| HP-ZX98YW76VU54| 1|
```

--------------------------------

### Example CSV Data for User Context Enrichment

Source: https://library.humio.com/examples/examples-matchasarray-user-context

This is an example of the CSV file format used with the `matchAsArray()` function. It contains user email addresses and associated identity details like entityID, displayName, and domain information.

```csv
user.email,entityID,displayName,user.active_directory.domain
testy@gmail.com,123,Testy McTestington,DET23.TEST
testy2@gmail.com,456,Tester2,DET23.TEST2
testy@gmail.com,789,Testy McTestington,DET23.IDPRO
```

--------------------------------

### Display Vulnerability Counts

Source: https://library.humio.com/examples/examples

Provides examples for displaying counts related to vulnerabilities. This includes identifying hosts with open vulnerabilities, counting active critical severity CVEs, and tracking the total number of open vulnerabilities.

```LogScale Query Language
Display Top 10 Hosts With Open Vulnerabilities
```

```LogScale Query Language
Display Count of Active Critical Severity CVEs
```

```LogScale Query Language
Display Count of Open Vulnerabilities
```

--------------------------------

### Display Vulnerability Counts

Source: https://library.humio.com/examples/index

Provides examples for displaying counts related to open vulnerabilities. This includes identifying hosts with open vulnerabilities, counting active critical severity CVEs, and tracking the total number of open vulnerabilities.

```logscale
# Display Top 10 Hosts With Open Vulnerabilities
# Example: ... | top(field="host", limit=10, sort=desc)

# Display Count of Active Critical Severity CVEs
# Example: ... | count(severity="critical")

# Display Count of Open Vulnerabilities
# Example: ... | count()
```

--------------------------------

### Reduce Field List with groupBy() and fieldset()

Source: https://library.humio.com/examples/examples-fieldset-list

This example demonstrates how to reduce the list of fields returned by fieldset() by first applying a groupBy() aggregation. This allows for a more focused view of fields relevant to specific groupings, such as event type and host.

```logscale
groupBy([#type,@host])
| fieldset()
```

--------------------------------

### Example CSV Input Data

Source: https://library.humio.com/examples/examples-parsecsv-2

This is an example of incoming data formatted as CSV, which can be parsed by the parseCsv() function. It includes quoted fields with internal spaces.

```csv
117, " crowdstrike.com, logscale.com ", 3.14
```

--------------------------------

### Handle Timestamp Parsing Errors in Humio

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-23450b63-8386-4cbb-81fc-1b69c45d8268

This example addresses a common issue where timestamps in log data cannot be parsed due to incorrect formatting. It highlights the error message and the problematic timestamp string, suggesting a need for data cleaning or format adjustment before ingestion or analysis.

```humo
// Filter for logs with timestamp parsing errors
"Error parsing timestamp" and errormsg =~ "Text '.*' could not be parsed at index 10"

```

--------------------------------

### Extract CrowdStrike Falcon Device JSON Data in Humio

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-ce927022-79a2-42cd-ae51-889cd8985a4e

This example shows how to extract detailed device information from JSON payloads within Humio logs. It focuses on parsing the 'CrowdStrike_Falcon_Devices' event, which contains comprehensive details about a device's configuration, policies, and status.

```humio
CrowdStrike_Falcon_Devices | parse json field=_raw "{ \"device_id\": \"DEV-9a0b1c2d\", \"cid\": \"d4e5f6g7h8i9j0k1l2m3\", \"agent_load_flags\": \"4\", \"agent_local_time\": \"2025-03-13:19:30:17 +0400\", \"agent_version\": \"6.45.15640.0\", \"bios_manufacturer\": \"Lenovo\", \"bios_version\": \"N1EET85W\", \"build_number\": \"18362\", \"config_id_base\": \"65994756\", \"config_id_build\": \"12348\", \"config_id_platform\": \"3\", \"cpu_signature\": \"263987\", \"external_ip\": \"192.168.0.234\", \"mac_address\": \"00:25:96:12:34:56\", \"hostname\": \"PROD-FILE01\", \"first_seen\": \"2025-03-13:11:45:55 -0400\", \"last_seen\": \"2025-03-14:02:10:23 +1100\", \"local_ip\": \"192.168.3.45\", \"machine_domain\": \"command-control.xyz\", \"major_version\": \"3\", \"minor_version\": \"3\", \"os_version\": \"Windows Server 2019\", \"os_build\": \"18363\", \"ou\": [], \"platform_id\": \"3\", \"platform_name\": \"Windows\", \"policies\": [ { \"policy_type\": \"prevention\", \"policy_id\": \"34c2eda9f67446daa84d28fd239635e8\", \"applied\": false, \"settings_hash\": \"ad4dc0bf\", \"assigned_date\": \"2025-03-13:09:25:44 -0600\", \"applied_date\": \"2025-03-13:21:40:12 +0600\", \"rule_groups\": [] } ], \"reduced_functionality_mode\": \"no\", \"device_policies\": { \"prevention\": { \"policy_type\": \"prevention\", \"policy_id\": \"6g8e3cce20g86hidc1ff29g43fd7c308\", \"applied\": true, \"settings_hash\": \"tagged|1;0\", \"assigned_date\": \"2025-03-13:15:15:38 +0000\", \"applied_date\": \"2025-03-13:18:30:19 +0300\", \"rule_groups\": [] }, \"sensor_update\": { \"policy_type\": \"sensor-update\", \"policy_id\": \"5f7d2bbd19f75ghcb0ee18f32ec6b297\", \"applied\": false, \"settings_hash\": \"b2b79cf7\", \"assigned_date\": \"2025-03-13:08:45:27 -0700\", \"applied_date\": \"2025-03-14:00:20:33 +0900\", \"uninstall_protection\": \"ENABLED\" }, \"device_control\": { \"policy_type\": \"device-control\", \"policy_id\": \"34c2eda9f67446daa84d28fd239635e8\", \"applied\": false, \"assigned_date\": \"2025-03-13:22:35:41 +0700\", \"applied_date\": \"2025-03-13:12:50:16 -0300\" }, \"global_config\": { \"policy_type\": \"globalconfig\", \"policy_id\": \"6g8e3cce20g86hidc1ff29g43fd7c308\", \"applied\": true, \"settings_hash\": \"f472bd8e\", \"assigned_date\": \"2025-03-13:16:15:28 +0100\", \"applied_date\": \"2025-03-14:01:30:45 +1000\" }, \"remote_response\": { \"policy_type\": \"remote-response\", \"policy_id\": \"bceb71599f5c4b6ea3c62de722a1194b\", \"applied\": false, \"settings_hash\": \"3c5ea1d8\", \"assigned_date\": \"2025-03-13:10:45:22 -0500\", \"applied_date\": \"2025-03-13:19:20:37 +0400\" }, \"firewall\": { \"policy_type\": \"firewall\", \"policy_id\": \"7234044d31914848a24cf2851078c9bd\", \"applied\": false, \"assigned_date\": \"2025-03-13:07:35:49 -0800\", \"applied_date\": \"2025-03-13:20:50:14 +0500\", \"rule_set_id\": \"bceb71599f5c4b6ea3c62de722a1194b\" } }, \"groups\": [], \"group_hash\": \"h6e3f77521if4f472dihi7f129ihe25750dh74h7972e267fd728224e0185e188\", \"product_type\": \"1\", \"product_type_desc\": \"Workstation\", \"provision_status\": \"Provisioned\", \"serial_number\": \"VMware-43 2g 6e 2d 70 de g0 14-9f 0e c0 7b e0 64 c8 46\", \"service_pack_major\": \"0\", \"service_pack_minor\": \"3\", \"pointer_size\": \"8\", \"site_name\": \"Branch01\", \"status\": \"lift_containment_pending\", \"system_manufacturer\": \"Lenovo\", \"system_product_name\": \"ThinkPad X1 Carbon\", \"tags\": [], \"modified_timestamp\": \"2025-03-14:00:15:26 +0900\", \"slow_changing_modified_timestamp\": \"2025-03-13:17:30:38 +0200\", \"meta\": { \"version\": \"16662\" } }"
```

--------------------------------

### Humio LogScale Query: Filter Events Relative to Query Start Time

Source: https://library.humio.com/examples/examples-relative-time

This Humio LogScale query uses the start() function to test if an event's @timestamp is earlier than the query's start time plus 30 days. It requires no external dependencies and takes log data as input, outputting filtered log events.

```logscale
test(@timestamp < (start() + (30*24*60*60*1000)))
```

--------------------------------

### Sample JSON Output for User Activity Events

Source: https://library.humio.com/examples/examples-crowdstrike-siem-connector-89a08397-5932-4199-901e-f203888d438f

This JSON snippet represents sample output data from the Humio user activity widget. It includes event details such as report IDs, customer IDs, user information, IP addresses, timestamps, services, and operations performed. This data is crucial for understanding and analyzing user actions within the system.

```json
[{"akey0":"scheduled_report_id","aval1":"123456781234567812345678","UserIP":"192.168.2.143","aval2":"detection_summary","Customer ID":"a1b2c3d4e5f6g7h8i9j0","User":"adamsb","aval0":"123456781234567812345678","akey1":"execution_id","@timestamp":1768898479081,"Service":"scheduled_reports","akey2":"report_metadata.subtype","Operation":"delete_report_execution"},
{"akey0":"AUD-9e3d5c8a","Operation":"create_policy","Customer ID":"k1l2m3n4o5p6q7r8s9t0","User":"bakerm","akey1":"AUD-56f1a7d2","@timestamp":1768898481267},
{"akey0":"AUD-0c8b3e9f","Customer ID":"l2m3n4o5p6q7r8s9t0u1","User":"blackj","akey1":"AUD-d4a7c2e5","@timestamp":1768898482042,"akey2":"AUD-38f6b1d9","Operation":"update_policy"},
{"akey0":"scheduled_report_id","aval1":"345678903456789034567890","UserIP":"192.168.1.178","aval2":"user_activity","Customer ID":"r8s9t0u1v2w3x4y5z6a7","User":"clarkd","aval0":"345678903456789034567890","akey1":"execution_id","@timestamp":1768898484857,"Service":"detections","akey2":"report_metadata.subtype","Operation":"create_report"},
{"akey0":"AUD-f7b2d9a1","Operation":"assign_policy","Customer ID":"o5p6q7r8s9t0u1v2w3x4","User":"davisr","akey1":"AUD-1d9c4e7b","@timestamp":1768898487088}]
```

--------------------------------

### Profile Query Performance with explain:asTable()

Source: https://library.humio.com/examples/examples

Analyzes the performance of query operations, including lookup, join, and general execution steps. It utilizes `explain:asTable()` in conjunction with functions like `defineTable()`, `match()`, and `join()` to provide detailed performance metrics.

```LogScale Query Language
explain:asTable()
```

```LogScale Query Language
explain:asTable() with defineTable() and match()
```

```LogScale Query Language
explain:asTable() with join()
```

--------------------------------

### Filter Events by 'cid' Field in LogScale

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-8dc4bcaa-d590-4fbf-9783-4f461424aec2

This LogScale query filters events to include only those that have a 'cid' field with any value. It serves as a starting point for more specific data analysis.

```logscale
cid=*
```

--------------------------------

### Exclude Servers Starting With 'web-' Prefix in LogScale

Source: https://library.humio.com/examples/examples-text-startswith-hostname-web-exclude

This LogScale query filters out events where the 'hostname' field does not start with the 'web-' prefix. It uses the negated `text:startsWith()` function to exclude specific server types, useful for monitoring backend infrastructure or focusing on non-web servers. The comparison is case-sensitive.

```logscale
!text:startsWith(string=hostname, substring="web-")
```

--------------------------------

### Count Hosts with Global Configuration Policy Applied (Humio Query)

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-c70ac37f-41b9-43a0-bfc6-fb300ca36d9b

This Humio query counts distinct device IDs where the global configuration policy is applied. It utilizes the `json:prettyPrint()` parser and filters based on the `device_policies.global_config.applied` field.

```humio
json:prettyPrint()
| cid=*
| device_policies.global_config.applied=true
| count(field="device_id", distinct=True)
```

--------------------------------

### LogScale: Get First 10 Error Events with head()

Source: https://library.humio.com/examples/examples-head-top-events-results

This LogScale query filters events for 'ERROR' loglevel and then uses the `head(10)` function to return only the first 10 matching events. This is useful for quickly previewing the earliest error occurrences. The `head()` function defaults to 200 events if no limit is specified and returns events in chronological order.

```logscale
loglevel=ERROR
head(10)
```

--------------------------------

### LogScale: Create Sample Groups Using Hash and GroupBy

Source: https://library.humio.com/examples/examples-hash-groupby-sampling

This LogScale query demonstrates how to create consistent sample groups from events using the hash() function on an IP address field, limiting the groups to 10 buckets. It then groups the events by the generated hash and counts them, enabling deterministic sampling and analysis of traffic patterns.

```logscale
hash(ip_address, limit=10)
groupBy(_hash, function=count())
```

--------------------------------

### Get Status Code Counts with groupBy() and count() in LogScale

Source: https://library.humio.com/examples/examples-groupby-list-statuscodes

This query uses the `groupBy()` function to group events by the 'status' field and the `count()` function to count the occurrences of each status code. It's useful for summarizing log data and understanding the frequency of different status codes. The output provides a table of status codes and their corresponding counts.

```logscale
groupBy(field=status, function=count())
```

```logscale
groupBy([field=status, field=source],           function=count(), limit=1000) | sort(_count, order=desc)
```

--------------------------------

### Preview Multiple CSV Files with readFile() and Limit

Source: https://library.humio.com/examples/examples-readfile-multiple-file-support

This example shows how to use the readFile() function with the 'limit' parameter to control the number of events outputted when previewing multiple CSV files. This is recommended for large files to ensure optimal UI performance. The function will output rows from the specified files in order until the limit is reached.

```logscale
readFile(["file1.csv", "file2.csv"], limit=6)
```

--------------------------------

### Get Last Array Element with getField() in LogScale

Source: https://library.humio.com/examples/examples-getfield-3

This query retrieves the last element of an array field. It first calculates the index of the last element, then constructs the field name dynamically using the index, and finally uses getField() to fetch the value. This method is useful when dealing with array fields where the last element needs to be accessed programmatically.

```logscale
| index := array:length("foo[]")-1
| fieldName := format("foo[%s]", field=[index])
| result := getField(fieldName)
```

--------------------------------

### Profile Query Performance with explain:asTable()

Source: https://library.humio.com/examples/examples-explain-astable-profile

Analyzes query execution steps and performance metrics using the explain:asTable() function. This function provides detailed statistics for each step in a query plan, helping to identify bottlenecks and understand optimization. The showPrefilters=false parameter excludes prefilter statistics.

```logscale
x = 42
| count()
| explain:asTable(showPrefilters=false)
```

--------------------------------

### Humio Log Entry with Standard Format

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-9b84a9d3-3a33-46fb-b41a-a06485fd4c82

This log entry follows a standard format with pipe-separated fields. It includes timestamps, event types, source information, and potentially other metadata, useful for general log analysis and filtering.

```log
5-03-13:17:30:38 +0200| lift_containment_pending| Lenovo| ThinkPad X1 Carbon
```

--------------------------------

### Select Oldest Events with head() in LogScale

Source: https://library.humio.com/examples/examples-neighbor-succeeding

The `head()` function in LogScale selects the oldest events from the source repository, ordered by time. This is often used as a starting point before applying other functions like `neighbor()`.

```logscale
head()
```

--------------------------------

### Parse Device Data with Humio Query Language

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-54242719-76b4-4520-984a-fc170119f750

This Humio query language (HQL) snippet demonstrates how to parse and extract key information from CrowdStrike Falcon device logs. It focuses on device ID, hostname, IP addresses, and operating system details. This query assumes the data is already ingested into Humio and is accessible.

```hql
from crowdstrike_falcon_devices
| parse "{ \"device_id\": \"*\", \"cid\": \"*\", \"agent_load_flags\": \"*\", \"agent_local_time\": \"*\", \"agent_version\": \"*\", \"bios_manufacturer\": \"*\", \"bios_version\": \"*\", \"build_number\": \"*\", \"config_id_base\": \"*\", \"config_id_build\": \"*\", \"config_id_platform\": \"*\", \"cpu_signature\": \"*\", \"external_ip\": \"*\", \"mac_address\": \"*\", \"hostname\": \"*\", \"first_seen\": \"*\", \"last_seen\": \"*\", \"local_ip\": \"*\", \"machine_domain\": \"*\", \"major_version\": \"*\", \"minor_version\": \"*\", \"os_version\": \"*\", \"os_build\": \"*\", \"ou\": [], \"platform_id\": \"*\", \"platform_name\": \"*\", \"policies\": [], \"reduced_functionality_mode\": \"*\", \"device_policies\": {}, \"groups\": [], \"group_hash\": \"*\", \"product_type\": \"*\", \"product_type_desc\": \"*\", \"provision_status\": \"*\", \"serial_number\": \"*\", \"service_pack_major\": \"*\", \"service_pack_minor\": \"*\", \"pointer_size\": \"*\", \"site_name\": \"*\", \"status\": \"*\", \"system_manufacturer\": \"*\", \"system_product_name\": \"*\", \"tags\": [], \"modified_timestamp\": \"*\", \"slow_changing_modified_timestamp\": \"*\", \"meta\": { \"version\": \"*\" } }" as device_data
| select device_data.device_id, device_data.hostname, device_data.external_ip, device_data.local_ip, device_data.os_version
```

--------------------------------

### CSV Parsing with trim=false

Source: https://library.humio.com/examples/examples-parsecsv-2

Illustrates the behavior of parseCsv() without the trim parameter (trim=false). In this scenario, spaces around the delimiter are included in the resulting column values, and quotation marks might not be interpreted as starting a quoted field.

```logscale
parseCsv(columns=[status, hosts, rest])
```

--------------------------------

### Sample Events using sample() function in LogScale

Source: https://library.humio.com/examples/examples-sample-events-percentage

This snippet demonstrates how to use the `sample()` function in LogScale to retain a specified percentage of events. It's useful for analyzing large datasets without processing every event and can be used to filter events based on frequency.

```logscale
sample(percentage=2)
```

--------------------------------

### Filter Hostnames Starting With 'web-' in LogScale

Source: https://library.humio.com/examples/examples-text-startswith-hostname-match-web

This LogScale query uses the text:startsWith() function to filter events where the 'hostname' field begins with the substring 'web-'. It is case-sensitive and useful for isolating logs from specific server types based on naming conventions.

```logscale
text:startsWith(string=hostname, substring="web-")
```

--------------------------------

### Filter Devices by Global Config Status

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-c70ac37f-41b9-43a0-bfc6-fb300ca36d9b

Filters events for devices where the `device_policies.global_config.applied` field is set to `true`, indicating devices with an applied global configuration policy.

```logscale
| device_policies.global_config.applied=true
```

--------------------------------

### Parse timestamp from 'ts' field for non-arrivaltime events in LogScale

Source: https://library.humio.com/examples/examples-copyevent-extracopy-1

This LogScale snippet handles events that are not of type 'arrivaltime'. It parses the timestamp from a field named 'ts', ensuring that original events retain their original timestamps while processed copies get updated timestamps.

```logscale
| parseTimestamp(field=ts) }
```

--------------------------------

### LogScale: Set Time Interval for Subqueries

Source: https://library.humio.com/examples/examples-settimeinterval-definetable

This LogScale snippet shows how `setTimeInterval()` affects subqueries defined by `defineTable()`. The `start` and `end` times of the subquery are calculated relative to the primary query's time settings, adjusted by the interval specified in `setTimeInterval()`.

```logscale
setTimeInterval(start="1h", end="30min")
```

--------------------------------

### Pretty-Print JSON in Humio

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-1266a95d-f7ad-447a-a354-3e9a66898d34

Formats JSON input into a human-readable structure with indentation and line breaks using the `json:prettyPrint()` function.

```logscale
json:prettyPrint()
```

--------------------------------

### Count Distinct Server Devices using LogScale Query

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-50929502-9400-4cde-acf0-121fca2f2e14

This query counts the number of distinct server devices. It filters for events where 'product_type_desc' is 'Server' and then uses the `count(field=device_id, distinct=True)` function to get the unique device count. The result is aliased to 'Number of Devices'.

```logscale
* "product_type_desc" = Server
| count(field=device_id, distinct=True)
| "Number of Devices" := rename(_count)
```

--------------------------------

### Count Real Time Response Policies

Source: https://library.humio.com/examples/index

Demonstrates how to count the number of unique real-time response policies configured in LogScale. This is useful for auditing and managing security policies.

```logscale
# Display Number of Real Time Response Policies
# Example: ... | count(unique=true, field="policy_name")
```

--------------------------------

### Filter Out Empty Fields in Humio Query

Source: https://library.humio.com/examples/examples-groupby-sort-excludenovalue

This Humio query filters events to include only those where the 'statuscode' field has a value. It first filters for GET requests, then groups by method and status code, counts the occurrences, sorts the results, and finally excludes any entries where a field is empty.

```logscale
method=GET
groupBy(field=[method, statuscode], function=count(as=method_total))
sort([method, statuscode], order=asc)
FieldName!=""
```

--------------------------------

### Count Firewall Events with LogScale

Source: https://library.humio.com/examples/examples-crowdstrike-siem-connector-e094d26d-bd5f-4d12-b7a6-913d73d411b3

This LogScale query counts all events where metadata.eventType is 'FirewallMatchEvent'. It starts by selecting all events, then filters for firewall events, and finally uses the count() function to aggregate the total number of matching events. This provides a simple metric for overall firewall activity.

```logscale
*
| metadata.eventType=FirewallMatchEvent
| count()
```

--------------------------------

### Preview Multiple CSV Files with readFile()

Source: https://library.humio.com/examples/examples-readfile-multiple-file-support

This snippet demonstrates how to use the readFile() function to preview and output rows from multiple CSV files as individual events. The files are processed and their rows outputted in the order they are specified in the function call. This is useful for inspecting lookup file content without matching against live data.

```logscale
readFile(["file1.csv", "file2.csv"])
```

--------------------------------

### Drop Array Fields with array:drop() in LogScale

Source: https://library.humio.com/examples/examples-array-drop

The `array:drop()` function removes all fields from a specified input array. It requires the array to have continuous, sequential indexes starting from 0. If there are empty indexes, fields are dropped only up to the first empty index. This example demonstrates dropping fields from array `a[]`.

```logscale
array:drop("a[]")
```

--------------------------------

### Select Specific Fields for Firewall Events in Humio

Source: https://library.humio.com/examples/examples-crowdstrike-siem-connector-25f1f3b1-a898-49f1-90ad-9556577dafcc

This query uses the `select()` function to create a table with specific fields related to firewall events, including host identification, event details, command execution, and network addressing.

```logscale
| select([event.HostName,event.DeviceId,event.EventType,event.PolicyName,event.RuleName,event.HostName,event.CommandLine,event.ImageFileName,event.LocalAddress,event.RemoteAddress])

```

--------------------------------

### Get AS Number and Organization for IP Address using LogScale

Source: https://library.humio.com/examples/examples-asn-2

This snippet shows how to use the `asn()` function in LogScale to extract the Autonomous System (AS) number and organization associated with an IP address. The `field` parameter specifies the IP address field, and the `as` parameter renames the output fields.

```logscale
asn(field=ipaddr,as=address)
```

--------------------------------

### Create Table View in LogScale

Source: https://library.humio.com/examples/examples-crowdstrike-siem-connector-89a08397-5932-4199-901e-f203888d438f

This final snippet formats the processed data into a table view, specifying the order and selection of columns. It includes timestamp, customer information, user details, service, operation, and the first 10 extracted audit key-value pairs.

```logscale
| table([@timestamp,"Customer ID",User,UserIP,Service,Operation,akey0,aval0,akey1,aval1,akey2,aval2,akey3,aval3,akey4,aval4,akey5,aval5,akey6,aval6,akey7,aval7,akey8,aval8,akey9,aval9,akey10,aval10])
```

--------------------------------

### Drop Comment Lines Using dropEvent() in LogScale Parser

Source: https://library.humio.com/examples/examples-dropevent-2

This LogScale query demonstrates how to drop events that start with a '#' character during the parsing phase. The dropEvent() function is used to remove these lines entirely from the ingest pipeline, preventing them from being stored in LogScale. This is useful for filtering out comment lines in data sources.

```logscale
case {
@rawstring="#*"
| dropEvent();
* }

```

--------------------------------

### Parse and Extract Device Information from Humio Logs

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-4aa09fe7-a10a-4324-b4f3-c1612d5ed2db

This snippet demonstrates how to parse semi-structured log lines and extract detailed device information, including policy details and system configurations. It handles potential errors during timestamp parsing.

```humio-query
time("yyyy-MM-dd'T'HH:mm:ss")
| parse "| " as timestamp, level, source, device_type, status, error_msg, json_data, hash, timestamp2, device_id, provision_status, applied_date, assigned_date, policy_id, policy_type, settings_hash, applied_date2, assigned_date2, policy_id2, policy_type2, settings_hash2, applied_date3, assigned_date3, policy_id3, policy_type3, settings_hash3, applied_date4, assigned_date4, policy_id4, policy_type4, settings_hash4, applied_date5, assigned_date5, policy_id5, policy_type5, settings_hash5, applied_date6, assigned_date6, policy_id6, policy_type6, settings_hash6, uninstall_protection, external_ip, first_seen, group_hash, hostname, last_seen, local_ip, mac_address, machine_domain, pointer_size, meta_version, platform_id, modified_timestamp, os_build, os_version, platform_name, product_type, service_pack_major, service_pack_minor, reduced_functionality_mode, serial_number, service_pack_major2, service_pack_minor2, build_number, os_build2, os_version2, platform_name2, product_type2, service_pack_major3, service_pack_minor3, modified_timestamp2, applied_date7, assigned_date7, policy_id7, policy_type7, settings_hash7, product_type_desc, provision_status2, reduced_functionality_mode2, serial_number2, service_pack_major4
| parse regex "(?P<json_payload>\{.*\})" "json_payload"
| json field=json_payload "device_id", "cid", "agent_load_flags", "agent_local_time", "agent_version", "bios_manufacturer", "bios_version", "build_number", "config_id_base", "config_id_build", "config_id_platform", "cpu_signature", "external_ip", "mac_address", "hostname", "first_seen", "last_seen", "local_ip", "machine_domain", "major_version", "minor_version", "os_version", "os_build", "ou", "platform_id", "platform_name", "policies", "reduced_functionality_mode", "device_policies", "groups", "group_hash", "product_type", "product_type_desc", "provision_status", "serial_number", "service_pack_major", "service_pack_minor", "pointer_size", "site_name", "status", "system_manufacturer", "system_product_name", "tags", "modified_timestamp", "slow_changing_modified_timestamp", "meta"
| where level != "Error parsing timestamp."
| select timestamp, device_id, hostname, os_version, json_payload
```

--------------------------------

### LogScale: Define Ad-Hoc Table with Time Constraints

Source: https://library.humio.com/examples/examples-settimeinterval-definetable

This LogScale code defines an ad-hoc table named `ended_queries` using `defineTable()`. It specifies start and end times relative to the primary query's time, incorporating the interval set by `setTimeInterval()`. This allows for focused analysis within a specific, dynamically defined time range.

```logscale
| defineTable(
start=7d,
end=1d,
query={...},
name="ended_queries")
```

--------------------------------

### Set Relative Time Interval with setTimeInterval() in LogScale

Source: https://library.humio.com/examples/examples-settimeinterval-basic

Demonstrates how to use the `setTimeInterval()` function to define a relative time interval for a LogScale query. This function must be placed in the preamble of the query and overrides any time settings specified in the QueryJobs API or UI. It accepts 'start' and 'end' parameters for relative time and optionally a 'timezone'.

```logscale
setTimeInterval(start=7d, end=1d)
```

```logscale
setTimeInterval(start="1w@d", end="now@d", timezone="Europe/Copenhagen")
```

--------------------------------

### Extract Device Information from Pipe-Delimited Logs

Source: https://library.humio.com/examples/examples-crowdstrike-falcon-devices-ffe799c2-7bcb-4dd4-a95c-1d16498c6b5f

This example shows how to parse a pipe-delimited log entry containing CrowdStrike device information using Humio's parsing capabilities. It extracts key fields like device ID, hostname, and OS version.

```hql
parse("pipe", "device_id, status, zone, pointer_size, agent_local_time, agent_version, bios_manufacturer, bios_version, build_number, cid, config_id_base, config_id_build, config_id_platform, cpu_signature, external_ip, applied_date_device_control, applied_date_firewall, policy_id_firewall, policy_type_firewall, applied_firewall, applied_date_globalconfig, policy_id_globalconfig, policy_type_globalconfig, applied_globalconfig, applied_date_prevention, policy_id_prevention, policy_type_prevention, applied_prevention, applied_date_remote_response, policy_id_remote_response, policy_type_remote_response, applied_remote_response, applied_date_sensor_update, policy_id_sensor_update, policy_type_sensor_update, applied_sensor_update, uninstall_protection, first_seen, group_hash, hostname, last_seen, local_ip, mac_address, machine_domain, major_version, meta_version, minor_version, modified_timestamp, os_build, os_version, platform_id, platform_name, pointer_size, reduced_functionality_mode, service_pack_major, service_pack_minor, site_name, slow_changing_modified_timestamp, system_manufacturer, system_product_name, tags, timestamp, version, service_pack_major, service_pack_minor, site_name, slow_changing_modified_timestamp, system_manufacturer, system_product_name, tags, timestamp, version, policy_id_prevention_2, policy_type_prevention_2, applied_prevention_2, settings_hash_prevention_2, assigned_date_prevention_2, applied_date_prevention_2, rule_groups_prevention_2, product_type, product_type_desc, provision_status, reduced_functionality_mode, serial_number, service_pack_major, service_pack_minor, pointer_size, site_name, status, system_manufacturer, system_product_name, tags, modified_timestamp, slow_changing_modified_timestamp, meta_version")
| where device_id != ""
| select device_id, hostname, os_version, platform_name, status
```

--------------------------------

### Find CPU Usage Range by Host using logscale

Source: https://library.humio.com/examples/examples-range-groupby-cpu

This query groups events by host and then calculates the range of CPU usage for each host. The range() function finds the difference between the maximum and minimum values in the 'cpu_usage' field. This is useful for identifying system stability, where a smaller range indicates more stable CPU usage.

```logscale
groupBy([host], function=range(cpu_usage))
```

--------------------------------

### LogScale Query: Group User Activity by Service Name

Source: https://library.humio.com/examples/examples-crowdstrike-siem-connector-69e734f1-700d-4467-b116-41e5e247ae26

This LogScale query filters for user activity events and groups them by service name to visualize distribution. It starts by selecting all events, then filters for UserActivityAuditEvent, ensures customer ID exists, and finally groups by event.ServiceName. The results are typically displayed as a bar chart.

```logscale
*
| metadata.eventType=UserActivityAuditEvent
| metadata.customerIDString = *
| groupby(event.ServiceName)
```

--------------------------------

### Filter AWS Resources using objectArray:exists() in LogScale

Source: https://library.humio.com/examples/examples-objectarray-exists-aws-resources

This LogScale query filters events by checking if any element in the 'Vendor.resources' array contains an ARN field matching the pattern 'arn:aws:*'. The 'objectArray:exists()' function is used to search through arrays and find elements that match specified conditions, particularly useful for nested JSON data. It helps in identifying AWS-specific resources in a multi-cloud setup.

```logscale
objectArray:exists(array="Vendor.resources[]", condition={Vendor.resources.ARN="arn:aws:*"})
```