topic Re: Help converting raw text into a simple stats table showing hostname and destination in All Apps and Add-ons

Help converting raw text into a simple stats table showing hostname and destination

gabarrygowin — Tue, 29 Sep 2020 15:25:43 GMT

Hi all,

Thanks for reading. I've tried a bunch of the offerings in the >answers forum with no luck. Here's my effort:

Need the following raw text to convert into a simple stats table showing hostname and destination.

Raw text:
8/23/17
6:29:10.000 PM

Aug 23 18:29:10 asbcnspap02.gab.com 08/23/2017:18:29:10 asbcnspap02 0-PPE-1 : default TCP CONN_TERMINATE 23913664 0 : Source 10.XXX.XXX.29:443 - Destination 10.120.209.12:4911 - Start Time 08/24/2017:01:28:25 GMT - End Time 08/24/2017:01:29:10 GMT - Total_bytes_send 1 - Total_bytes_recv 1

Current search (not resolving):

index=infrastructure 10.120.213.29 | stats count by Source, Destination | lookup dnslookup clienthost OUTPUT clientip

Any help MUCH appreciated!

Re: Help converting raw text into a simple stats table showing hostname and destination

somesoni2 — Thu, 24 Aug 2017 04:19:34 GMT

Try like this

index=infrastructure 10.120.213.29 | stats count by Source, Destination | lookup dnslookup clientip as Source OUTPUT clienthost as Source_Host   | lookup dnslookup clientip as Destination OUTPUT clienthost as Destination_Host

Re: Help converting raw text into a simple stats table showing hostname and destination

s2_splunk — Thu, 24 Aug 2017 08:23:20 GMT

Note that the search (before the first "|") resolves to index=infrastructure 10 AND 120 AND 213 AND 29, because the '.' is a minor segmenter, so it breaks up the IP address into four individual terms. Hence, it may not retrieve exactly what you need. (You can see the search being executed in the search.log, found in the Job Inspector, if you search for "Lispy")
Example:
08-24-2017 01:18:18.579 INFO UnifiedSearch - Expanded index search = ( index=infrastructure 10.120.213.29 )
08-24-2017 01:18:18.580 INFO UnifiedSearch - base lispy: [ AND 10 120 213 29 index::infrastructure ]

Docs for how to handle it here

Re: Help converting raw text into a simple stats table showing hostname and destination

gabarrygowin — Thu, 24 Aug 2017 15:59:29 GMT

Thanks much sslevert!

I finally got that all figured out and appreciate the leading help.

Re: Help converting raw text into a simple stats table showing hostname and destination

s2_splunk — Thu, 24 Aug 2017 17:29:07 GMT

Cool. Please accept somesoni2's answer to mark it as resolved for posterity.