topic Re: To analyse the traffic of specific ip address , dest with port in Splunk Search

How to analyse the traffic of specific ip address , dest with port?

Jana42855 — Thu, 14 Sep 2023 16:59:46 GMT

Hi All,

i didn't get the result by using this below query search.
how to check and confirm the index and source type specifically to precise the query

index=*| search src=**.**.***.** OR **.**.***.** dest_ip=**.***.***.*** dest_port=443

How to confirm the source type and index

Re: To analyse the traffic of specific ip address , dest with port

gcusello — Wed, 13 Sep 2023 15:52:30 GMT

Hi @Jana42855 ,

I suppose that you already have the log indexed and stored in an index with one sourcetype.

At first you should define the index where the logs are stored and the sourcetype to use.

Then, using this index and this sourcetype, you should check if the field names are correct (field names are case sensitive) and if the fields to use in the search ( src, dest_ip, dest_port) are present in all events.

then you don't need to use the search command, put all the parameters in the main search, you'll have a more performant search, then don't use index=*, because is slower than index=your_index.

index=<your_index> src=**.**.***.** OR **.**.***.** dest_ip=**.***.***.*** dest_port=443

Ciao.

Giuseppe

Re: To analyse the traffic of specific ip address , dest with port

Jana42855 — Wed, 13 Sep 2023 16:05:57 GMT

Hi Thanks for the reply..

yes I have some index and sourcetypes
but I don't know how to choose the index and sourcetypes for this ip address

Thanks,

Re: To analyse the traffic of specific ip address , dest with port

yuanliu — Thu, 14 Sep 2023 06:56:27 GMT

yes I have some index and sourcetypes
but I don't know how to choose the index and sourcetypes for this ip address

Can you confirm this: So you want to know which index/indices, and which sourcetype(s) contain records of interest. Is this correct?

index=* src=**.**.***.** OR **.**.***.** dest_ip=**.***.***.*** dest_port=443 | stats count by index sourcetype

This should give you a list of index-sourcetype combinations that contain the specific IP and port. (Also, if you can use search command immediately following a search command, the two search commands should be combined into one. (The first command is an implied "search".)

Re: To analyse the traffic of specific ip address , dest with port

gcusello — Thu, 14 Sep 2023 07:59:19 GMT

Hi @Jana42855,

the first step is to know the data to search, otherwise it's very difficoult!

Anyway, you could start to run a search like the following:

index=<your_index> (src=* OR dest_ip=* OR dest_port=*)

in this way you have all the events containing these fields.

then you can analyze them and identify index and sourcetype to use.

Remember that you can see only the indexes where you were enabled, in other words, if you don't have grants to access an index you don't see it.

Ciao.

Giuseppe