topic Re: How can I send event log to custom search commands in Splunk Enterprise

How can I send event log to custom search commands

bkhwang — Fri, 30 Dec 2022 10:46:37 GMT

Hello !!

I want to read index=test line by line and then analyze log by log_dict and parser_log function..

is it possible??

I am very desperate to solve this problem. please help me..ㅠ.ㅠ

@Configuration() class GenerateTESTCommand(GeneratingCommand): event_log = read event_log(index) def generate(self): log = self.log_dict(self.event_log) if log: try: result = self.parse_log(log) yield result except BaseException as ex: print(log, ex)

Re: How can I send event log to custom search commands

ITWhisperer — Fri, 30 Dec 2022 12:08:43 GMT

If you are struggling to write a custom command, perhaps if you describe exactly what you are trying to achieve, there may be another way to do it with SPL?

Re: How can I send event log to custom search commands

bkhwang — Fri, 30 Dec 2022 12:41:30 GMT

Umm I want to analyze my office log by other platform(like shodan)

Firtst, I send firewall log to splunk server and make index like index='test'

Second, if new log occured, my custom searchcommands read log and return new log which analyzed by shodan, censys.

Third, Draw graphes on dashboard with a new log

Re: How can I send event log to custom search commands

ITWhisperer — Fri, 30 Dec 2022 17:23:52 GMT

That doesn't really explain what analysis shodan is doing so it is not possible to determine whether this could be done in SPL instead.

Re: How can I send event log to custom search commands

bkhwang — Sat, 31 Dec 2022 01:25:19 GMT

Event log looks like event_log = ' "srcip" = "1.1.1.1"'

Analyze event_log using python script(searchcommand)

After analyze, new_log made

python script -> shodan.api(event_log) -> new_log

new_log = '"srcip" = "1.1.1.1", "srccountry=Japan"'