Alerting

Webproxy search help

fdevera
Path Finder

Hi I've got this webproxy ES base search where I'm trying to show high number of destinations from a low number of sources. I would also like to throttle the search by going back 24hr, then only looking at the most recent time. How best to do that?

| tstats `summariesonly` count min(_time) as first_seen max(_time) as last_seen values(Web.action) as Web.action from datamodel=Web.Web WHERE index=webproxy Web.action=allowed
by Web.src Web.dest
| `drop_dm_object_name("Web")`
| convert ctime(*_seen)
| lookup dnslookup clientip AS dest OUTPUT clienthost AS dest_host
| lookup dnslookup clientip AS src OUTPUT clienthost AS src_host
| search NOT src_host=drekar-rancher-ccena*
| sort - count

 

Labels (2)
Tags (1)
0 Karma

fdevera
Path Finder

Bump

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...