topic Re: stats count help in Splunk Search

stats count help

hermeslxxv — Sun, 03 Apr 2016 17:58:31 GMT

I am pulling syslogs and attempting to count IPs that are blocked for abuse. My counts are coming up 0. the IP used has been banned by two devices in the last 48hrs, and more than once in one of the devices. here is my xml search query so far;

index=aaa source=tcp:5146 NetworkDeviceName=*SOME-ROUTER* BAD-CUST 10.20.30.40 AND NOT "no ip prefix-list" AND NOT "show ip prefix-list" AND NOT "do sh" | rex field=CmdSet mode=sed "s/\[ CmdAV=//g" | rex field=CmdSet mode=sed "s/\]//g" | rex field=CmdSet "permit (?<dvc_ip>\d+\.\d+\.\d+\.\d+)\/32" | rename dvc_ip as "IP Blocked" | stats count(eval(method="48HRs")) AS 48HRs BY "IP Blocked" NetworkDeviceName

and the result im trying to achieve;

IP blocked NetworkDeviceName 48HRs
10.20.30.40 one-some-router 2
10.20.30.40 two-some-router 1

Thanks for any suggestions

Re: stats count help

richgalloway — Sun, 03 Apr 2016 18:01:54 GMT

Can you share some sample events?

Re: stats count help

woodcock — Sun, 03 Apr 2016 18:14:42 GMT

Either your method field or your dv_ip field is not there. Back of your commands from the end one-by-one until you see stuff that works and then figure out why the stuff you just stripped isn't working. Probably bad RegEx.

Re: stats count help

hermeslxxv — Sun, 03 Apr 2016 18:18:50 GMT

something specific that would help? the CmdSet field is what im searching against, in this case it is identical for all the events aside from a time stamp and the device name.

Feb 15 02:05:29,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=ONE-SOME-ROUTER
Feb 15 02:05:29,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=TWO-SOME-ROUTER
Feb 10 04:02:11,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=ONE-SOME-ROUTER

Re: stats count help

martin_mueller — Sun, 03 Apr 2016 21:51:40 GMT

Additionally to backtracking commands, I'd recommend using search or where commands to filter for the method value rather than stuffing too much logic into stats - that quickly becomes hard to debug.

Re: stats count help

meenal901 — Fri, 08 Apr 2016 09:15:35 GMT

method field is missing. Can you check once by backtracing before rex and printing out method. Rex looks fine to me, but do check the results once.
Backtracing is the only way to debug your queries 🙂