topic Re: Splunk Search Syntax to show service & dstport in Splunk Enterprise

Splunk Search Syntax to show service & dstport

Naz_Lightening — Thu, 15 Jul 2021 11:18:52 GMT

Hi,

I'm running the below syntax on Splunk Enterprise to get traffic logs from Fortigate firewalls:

index="fortinet" "devname=" "xxxxx-xxxxxx" "vd=" "xxx-xxxxx" policyid=5 action=accept
| stats count by srcip, dstip, dstport, service, action, date, time, policyid
| dedup srcip dstip dstport service consecutive=true
| sort 0 field

This gives me all TCP & UDP traffic, then I can download & filter in a .csv but doesn't pick up ICMP traffic (specifically icmp type 8). I have to run a separate syntax to get just ICMP as below:

index="fortinet" "devname=" "xxxxx-xxxxxx" "vd=" "xxx-xxxxx" policyid=5 action=accept
| stats count by srcip, dstip, service, action, date, time, policyid
| dedup srcip dstip service consecutive=true
| sort 0 field

It seems that because ICMP has no dstport the syntax needs adjusting.

I need is a syntax that will return all traffic, i.e. TCP, UDP & ICMP.

Please advise?

Naz

Re: Splunk Search Syntax to show service & dstport

venkatasri — Thu, 15 Jul 2021 11:40:24 GMT

Hi @Naz_Lightening

Can you try this SPL? I hope it works without looking at data its a guess let me know how you go.

index="fortinet" "devname=" "xxxxx-xxxxxx" "vd=" "xxx-xxxxx" policyid=5 action=accept | eval dstport=if(isnull(dstport),"none", dstport) | stats count by srcip, dstip, dstport, service, action, date, time, policyid | dedup srcip dstip dstport service consecutive=true | search dstport!="none" | sort 0 field

An upvote would be appreciated and Accept solution if this reply helps!

Re: Splunk Search Syntax to show service & dstport

ITWhisperer — Thu, 15 Jul 2021 11:52:35 GMT

Try fillnull for the dstport

index="fortinet" "devname=" "xxxxx-xxxxxx" "vd=" "xxx-xxxxx" policyid=5 action=accept | fillnull value=0 dstport | stats count by srcip, dstip, dstport, service, action, date, time, policyid | dedup srcip dstip dstport service consecutive=true | sort 0 field

Re: Splunk Search Syntax to show service & dstport

Naz_Lightening — Thu, 15 Jul 2021 13:29:03 GMT

@ITWhisperer cheers that's done it nicely!