topic Re: Can you help me fix my search in Splunk Search

Can you help me fix my search

NeAllen — Mon, 30 Oct 2023 03:28:21 GMT

Hi,

Below is my current search at the moment,

index=o365 sourcetype=* src_ip="141.*"
| rex field=_raw "download:(?<download_bytes>\d+)"
| rex field=_raw "upload:(?<upload_bytes>\d+)"
| dedup UserId, ClientIP
| table UserId, download_bytes, upload_bytes
| head 10

I am trying to get downloaded bytes and uploaded bytes into a table and find out if anything suspicious is going on in the network however I have been unable to return anything other than the source ip.

Thanks in advance.

Re: Can you help me fix my search

yuanliu — Mon, 30 Oct 2023 05:26:24 GMT

Pro tip: To get help about data analytics, present sample data (in text, anonymize as needed), illustrate desired output (in text), and describe the logic between the data and output. If you have a command that does not give the desired output, illustrate the actual output (anonymize as needed) and explain why it is different from desired output if not painfully obvious).

Re: Can you help me fix my search

inventsekar — Mon, 30 Oct 2023 06:37:03 GMT

Hi @NeAllen .. you may need only one rex command (with two matchings inside that single rex).

the sample logs are needed, then only we can troubleshoot why the rex is not working as expected. thanks.

Re: Can you help me fix my search

gcusello — Mon, 30 Oct 2023 07:02:50 GMT

Hi @NeAllen ,

to debug your search I need some sample of your logs to check the regexes.

Then I see a strange thing.

when using head you shuld sort to that the most relevant events and not only then events.

So osrting e.g. for the sum of download_bytes and upload_bytes, you coulr run something like this:

index=o365 sourcetype=* src_ip="141.*" | rex field=_raw "download:(?<download_bytes>\d+)" | rex field=_raw "upload:(?<upload_bytes>\d+)" | eval total_bytes=download_bytes+upload_bytes | sort 10 -total_bytes | table UserId total_bytes download_bytes upload_bytes

Ciao.

Giuseppe