topic Re: Monitoring services and process and which port using in Getting Data In

Monitoring services and process and which port using

test_qweqwe — Sun, 07 Jun 2020 00:10:42 GMT

HI.
I know how to monitoring process and services in Windows, but I don't know how to see port which use process/service.
All logs that I have right now and including process/services not have any fields with ports.
For example, I wanna make one table which will include service/process and port. How can I realize it?

Re: Monitoring services and process and which port using

nickhills — Mon, 18 Dec 2017 16:40:42 GMT

Is this on a universal forwarder - and which OS?

Re: Monitoring services and process and which port using

nickhills — Tue, 29 Sep 2020 17:19:28 GMT

Preempting your reply.

If your universal forwarders are *nix based, the splunk_TA_nix TAcomes with an input called openPortsEnhanced.sh which you can enable.
Add the following to your inputs.conf in the TA.

[script://./bin/openPortsEnhanced.sh]
disabled = false

It will yield results as follows:

Mon Dec 18 16:43:54 GMT 2017 app=splunkd dest_ip=* dest_port=8089 pid=34624 user=splunk fd=5u ip_version=4 dvc_id=46637453 transport=TCP
Mon Dec 18 16:43:54 GMT 2017 app=splunkd dest_ip=* dest_port=8000 pid=34624 user=splunk fd=53u ip_version=4 dvc_id=46655525 transport=TCP
Mon Dec 18 16:43:54 GMT 2017 app=mongod dest_ip=* dest_port=8191 pid=36671 user=splunk fd=5u ip_version=4 dvc_id=46645516 transport=TCP
Mon Dec 18 16:43:54 GMT 2017 app=python dest_ip=127.0.0.1 dest_port=8065 pid=36831 user=splunk fd=15u ip_version=4 dvc_id=46655518 transport=TCP

Re: Monitoring services and process and which port using

adigrio — Mon, 18 Dec 2017 16:58:39 GMT

On Splunk Windows 64-bit installations you can configure a Splunk network monitoring data input to collect this type of information:

This will collect quite a lot of details about each TCP/IP connection on that system. Here is a sample list:

Re: Monitoring services and process and which port using

test_qweqwe — Mon, 18 Dec 2017 21:16:52 GMT

Thank you for answer!

Re: Monitoring services and process and which port using

ttovarzoll — Thu, 30 Apr 2020 22:22:15 GMT

This looks great but I don't see an input-type, "Splunk network monitoring" when I try to add it to my Splunk Enterprise 7.3 environment. Is that a particular add-on or app?

Re: Monitoring services and process and which port using

jacobpevans — Thu, 11 Jun 2020 12:22:56 GMT

Splunk Add-on for Microsoft Windows

https://splunkbase.splunk.com/app/742/