All Apps and Add-ons

Grouping log events to show uplink and down link traffic

nrelihan
Explorer

Hey,
I would like to couple two events together that would show the uplink and downlink traffic.
These two events would be in different location in the logs, depending on how long it takes the events to occur.

"10.159.216.131","61096/UDP","10.4.4.34","53/UDP (DNS)","Serial2/0.101","GigabitEthernet0
"10.4.4.34","53/UDP (DNS)","10.159.216.131","61096/UDP","GigabitEthernet0/1","Serial2

I have tried using the transaction funtion, to no avail, any suggestions on how this would be achieved?

Thanks alot.

Neil

Tags (1)
0 Karma

bobbyfaber
Explorer

Maybe you can give us some more detail? Have you named these fields?
It appears that if the port number (61096/UDP) is extracted in both cases (perhaps as 'port') one could do:

transaction port

or

stats port

Depending on the rest of the data, some other massaging may be needed.

0 Karma

nrelihan
Explorer

Yeah sorry, the first and second IP addresses are parsed as src and dst IPs. The "61096/UDP" field as src_port and 53/UDP (DNS) as dst_port.
The problem with doing "transaction dst_port src_port" for instance is that it comes back with multiple events that posses these fields, but what I require is to have the uplink and down link grouped together.
Cheers

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...