topic Re: correlate between two sources in Splunk Search

correlate between two sources

khanlarloo — Sat, 19 May 2018 10:58:08 GMT

hi
i have tow devices, i want to check the result of the same event in tow devices.
for example if one source is blocked in one device on another device what is the action!

Device A = fw=x.x.x.x msg=""Connection Closed" " appName=""General HTTP"" n=366680949 src=150.X.X.55:34884:X1 dst=192.168.x.x:80:X2
Device B = risk=None, event=""Other"", proxy=""://generic:"",, source=""150.X.X.55"", violation=""Invalid hostname"", path=""/"",
method=""GET"", node=""WebApplicationFirewall"", action=""Block""

in device A the ip is connection closed and on the device b the ip is blocked

tanx

Re: correlate between two sources

jkat54 — Sat, 19 May 2018 11:59:21 GMT

... root / base search...
| rename action as msg 
| rex “Device (?<dvc>\w+)”
| stats latest(msg) by dvc

You’ll need to be in verbose or maybe smart mode for this to work.

Re: correlate between two sources

khanlarloo — Sat, 25 Aug 2018 09:38:38 GMT

if i want to search base on host name how can i write the regex format?
host="12.13.2.1"
host="2.1.1.4"