All Apps and Add-ons

Help converting raw text into a simple stats table showing hostname and destination

gabarrygowin
Path Finder

Hi all,

Thanks for reading. I've tried a bunch of the offerings in the >answers forum with no luck. Here's my effort:

Need the following raw text to convert into a simple stats table showing hostname and destination.

Raw text:
8/23/17
6:29:10.000 PM

Aug 23 18:29:10 asbcnspap02.gab.com 08/23/2017:18:29:10 asbcnspap02 0-PPE-1 : default TCP CONN_TERMINATE 23913664 0 : Source 10.XXX.XXX.29:443 - Destination 10.120.209.12:4911 - Start Time 08/24/2017:01:28:25 GMT - End Time 08/24/2017:01:29:10 GMT - Total_bytes_send 1 - Total_bytes_recv 1

Current search (not resolving):

index=infrastructure 10.120.213.29 | stats count by Source, Destination | lookup dnslookup clienthost OUTPUT clientip 

Any help MUCH appreciated!

0 Karma

somesoni2
Revered Legend

Try like this

index=infrastructure 10.120.213.29 | stats count by Source, Destination | lookup dnslookup clientip as Source OUTPUT clienthost as Source_Host   | lookup dnslookup clientip as Destination OUTPUT clienthost as Destination_Host 
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Note that the search (before the first "|") resolves to index=infrastructure 10 AND 120 AND 213 AND 29, because the '.' is a minor segmenter, so it breaks up the IP address into four individual terms. Hence, it may not retrieve exactly what you need. (You can see the search being executed in the search.log, found in the Job Inspector, if you search for "Lispy")
Example:
08-24-2017 01:18:18.579 INFO UnifiedSearch - Expanded index search = ( index=infrastructure 10.120.213.29 )
08-24-2017 01:18:18.580 INFO UnifiedSearch - base lispy: [ AND 10 120 213 29 index::infrastructure ]

Docs for how to handle it here

0 Karma

gabarrygowin
Path Finder

Thanks much sslevert!

I finally got that all figured out and appreciate the leading help.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Cool. Please accept somesoni2's answer to mark it as resolved for posterity.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...