topic Re: Combine two searches using Eval with Case statement. in Splunk Search

Combine two searches using Eval with Case statement.

abdimustafa12 — Tue, 08 Mar 2016 21:04:02 GMT

Combine two searches using Eval with Case statement.

Re: Combine two searches using Eval with Case statement.

lguinn2 — Tue, 08 Mar 2016 21:45:18 GMT

sourcetype=Firewall action=allowed (port=21 OR port=22 OR port=20) 
       (dst!=10.0.0.0/8 dst!=192.168.0.0/16 ) OR (src!=10.0.0.0/8 src!=192.168.0.0/16)
| iplocation dst
| search Country!="United States"
| stats Count by Country src dst port action

This is a start - but the real problem is: how do you determine the direction? Without that information, the whole search doesn't really make sense to me.

Re: Combine two searches using Eval with Case statement.

somesoni2 — Tue, 08 Mar 2016 22:39:49 GMT

Give this a try

sourcetype=Firewall action=allowed port=21 OR port=22 OR port=20
| eval Direction=case(dst!="10.0.0.0/8" AND  dst!="192.168.0.0/16","OUTBOUND",src!="10.0.0.0/8" AND src!="192.168.0.0/16","INBOUND",1=1,"Other") | where Direction!="Other" | iplocation dst | rename Country as Country_dst | iplocation src | where Country!="United States" OR Country_dst!="United States" | stats Count byCountry src dst port action Direction

Re: Combine two searches using Eval with Case statement.

chimell — Wed, 09 Mar 2016 08:47:00 GMT

Hi
Try this

 sourcetype=Firewall action=allowed port=21 OR port=22 OR port=20
 | eval Direction=case((dst!="10.0.0.0/8" AND  dst!="192.168.0.0/16"),"OUTBOUND",(src!="10.0.0.0/8" AND src!="192.168.0.0/16"),"INBOUND")| iplocation dst | where Country!="United States" | stats Count by Country src dst port action Direction