topic Re: Problem with Cisco ASA search query (iplocation) in Splunk Search

Problem with Cisco ASA search query (iplocation)

madstylex — Thu, 17 Mar 2016 01:19:06 GMT

Hi,

I have a search string that shows the top 20 security related events by country on my Cisco ASA.

eventtype=cisco-security-events | iplocation src_ip | stats count by Country | sort 20 - count

It works well and displays the countries and total number of events for whichever time range I've specified.

However, when I want to click an individual country (Australia) and view the events, Splunk returns "No Results Found". Even though there are 8000+ events for Australia

A manual search also shows no results found:

eventtype=cisco-security-events  Country=Australia | iplocation src_ip

Can someone please explain why this is happening and kindly offer a solution?

Thanks Ninjas!

Re: Problem with Cisco ASA search query (iplocation)

maciep — Thu, 17 Mar 2016 02:17:09 GMT

The problem is likely that the Country field doesn't exist until the iplocation command creates it. So for your manual, search, does something like this work?

eventtype=cisco-security-events | iplocation src_ip | where Country="Australia"

Re: Problem with Cisco ASA search query (iplocation)

madstylex — Thu, 17 Mar 2016 02:28:29 GMT

That manual search does indeed work. Any idea on how to view the events by clicking through the results of my top 20 search?

Re: Problem with Cisco ASA search query (iplocation)

maciep — Thu, 17 Mar 2016 13:04:34 GMT

Splunk tries to figure out how to drill down on its own, but doesn't always do a good job. If this is in a dashboard, Splunk allows you to configure how that works. I included some links below.

But I wonder if you change your base search to something like this, whether Splunk will add the country condition to a later spot in the search when drilling down for you?

 eventtype=cisco-security-events | iplocation src_ip | search Country=* | stats count by Country | sort 20 - count

http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/Understandbasictableandchartdrilldownactions

http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms

Re: Problem with Cisco ASA search query (iplocation)

ndoshi — Tue, 18 Apr 2017 03:17:59 GMT

I just tested your idea of eventtype=cisco-security-events | iplocation src_ip | search Country=* | stats count by Country | sort 20 - count and that seems to work for a drilldown with iplocation without having to do anything more.