topic Re: Splunk Query for user accessing assets in Splunk Search

Splunk Query for user accessing assets

sarwshai — Tue, 07 Apr 2020 07:13:13 GMT

Hi All,

I need to create a query where user access a same destination from 5 or more sources, also in that query opposite should also be achieved i.e. 5 or more destination and 1 source, is it possible?

Re: Splunk Query for user accessing assets

gcusello — Tue, 07 Apr 2020 08:06:14 GMT

Hi @sarwshai,
you have to use the stats command with the dc (distinct_count) option.
e.g. something like this:

index=your_index
| stats dc(src_ip) AS dc_src BY user dts_ip
| where dc_src>5

or in the other case:

index=your_index
| stats dc(dst_ip) AS dc_dst BY user src_ip
| where dc_dst>5

Ciao.
Giuseppe

Re: Splunk Query for user accessing assets

sarwshai — Tue, 07 Apr 2020 09:16:34 GMT

Thanks @gcusello , however i want both conditions in same search itself.

Re: Splunk Query for user accessing assets

gcusello — Tue, 07 Apr 2020 09:40:18 GMT

Hi @sarwshai,
try something like this (it runs if the second search has less than 50,000 results!):

index=your_index
| stats dc(src) AS dc_src values(src) AS src BY user dst
| where dc_src>5
| append [ search 
     index=your_index
     | stats dc(dst) AS dc_dst values(dst) AS dst BY user src
     | where dc_dst>5
     ]
| table user src dst

Ciao.
Giuseppe

Re: Splunk Query for user accessing assets

sarwshai — Wed, 08 Apr 2020 11:27:32 GMT

Thanks @gcusello , it kind of worked for me.

Re: Splunk Query for user accessing assets

gcusello — Wed, 08 Apr 2020 12:16:47 GMT

Hi @sarwshai,
You're welcome!
if this answer solves your need, please accept it for the other people of Community.

Ciao and next time.
Giuseppe