Index without time restriction

[arkonner]

I created and index importing a csv file. The file contain the VPN Ip address assigned to a users.

I will try to use it joining with a index from an apache web log where the there is the Ip but not the name.

The search is taking in consideration the date/time of the creation of the index from csv file. Should be possible to run the search considering the event time only from the apache web log?

Thank you in advance

[yannK]

Are you looking for a time based lookup ?
To be able to tell which IP was being using the VPN at a given time , you will need a lookup with the beginning of the session, and the temporary IP and the identity)

see this guide
http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Addfieldsfromexternaldatasources#Time-bo...

[arkonner]

Sorry for my late reply, I am new on Splunk, any help is a massive step forward. Thank you in advance.

I am trying to configure two dashboards showing us a daily picture of:

Web Pages visited Account (user name) Division Time of visit

Basically who is looking at what when.

Presently, I have created two dashboard - one for lan access and one for vpn access
The search below, in order to display who, what, div and time should be joined with the index rsa created from a csv file.

Vpn Access
index="access_combined_apache" Source_IP !=10.3.36.65 AND Source_IP !=10.3.* AND Source_IP !=localhost AND Source_IP !=127.0.0.1 AND Source_IP !=146.247* AND Source_IP !=- AND uri_path !=/access-denied.html AND uri_path !=.ico AND uri_path !=.png AND uri_path !=.gif AND uri_path !=.jpg AND uri_path !=.js AND uri_path !=.css AND uri_path !=.jsp AND uri_path !=.pdf AND uri_path !=.ico AND uri_path !=.html AND uri_path !=/image AND uri_path !=/c/* AND uri_path !=/c AND uri_path !=/image/* AND uri_path !=/template* AND uri_path !=/documents* | rename Source_IP as Client_Address| rename uri_path as Web_page_Visited|dedup Web_page_Visited Client_Address| table Client_Address Web_page_Visited _time

Result

Address VPN, Page, Time

index="rsa" | table Account_Name Division Computer_Network_Address - File csv with import time that would be ignored

1Mario Rossi ABC 172.16.00.12
2 David Brown CBB 172.16.11.22
.
.
.
571 Fabrizio White BCA 172.16.00.3

Results: Name, Division, Address VPN

The 2nd search for the dashboard referring to the LAN should be the combination of the follow index/source

Internal Network (only) –
index="access_combined_apache" Source_IP !=10.3.36.65 AND Source_IP !=localhost AND Source_IP !=172* AND Source_IP !=127.0.0.1 AND Source_IP !=146.247* AND Source_IP !=- AND uri_path !=/access-denied.html AND uri_path !=.ico AND uri_path !=.png AND uri_path !=.gif AND uri_path !=.jpg AND uri_path !=.js AND uri_path !=.css AND uri_path !=.jsp AND uri_path !=.pdf AND uri_path !=.ico AND uri_path !=.html AND uri_path !=/image AND uri_path !=/c/* AND uri_path !=/c AND uri_path !=/image/* AND uri_path !=/template* AND uri_path !=/documents* | rename Source_IP as Client_Address| rename uri_path as Web_page_Visited|dedup Web_page_Visited Client_Address| table Client_Address Web_page_Visited _time

Result Client(ip) Page Visited Time (no Account Name)

User Access - The index"main" is referring to Active Directory
index="access_combined_apache" Source_IP !=10.3.36.65 AND Source_IP !=localhost AND Source_IP !=- AND Source_IP !=localhost AND Source_IP !=127.0.0.1 AND Source_IP !=146.247* | eval Source_Network_Address=Source_IP | table Source_Network_Address | JOIN[search index="main" | dedup Account_Name | table Source_Network_Address Account_Name] | dedup Account_Name | table Account_Name Source_Network_Address

Result Account_Name Network_Address

index="main" source=ActiveDirectory division="" displayName="" | dedup displayName | table displayName division
1 Giovanni Verdi BCF
.
.
1200 Paolo Brown ALLalt text

Result Display Name Division

[somesoni2]

So you want to combine data from index="access_combined_apache" with data from index="rsa" so that you can get the Account_Name from index="rsa", but query from index="rsa" should run for all time (should not be limited to time range selected in the dashboard)??

[arkonner]

I am trying to explain myself better - The rsa index is dated 1st july 2015 and inside there is User and His IP and the division. The IP assigned to a specific user doesn't change.

The index access_combined_apache is updated with the events in real time - basically The page visited by IP.

Trying to join the two index to obtain Name, Division IP, Page Visited, Time - I have a problem to exclude the Time factor from rsa's index; this would be used as a reference table in any time.

[yannK]

arkonner : basically you need your timerange condition to apply to one search (the apache logs) but not the other (rsa logs), or at least a different timerange.

you can use 2 searches and a join, and apply different timerange to each

<searchonapache> earliest=-7d latest=now | join theipfield [  search <myserachonrsa>  earliest="2015-07-01T00:00:00" latest="2015-07-02T00:00:00"|| stats count by theuser theipfield ]   | <my other stats>

Another approach to avoid doing a subsearch every time is to schedule a search on the rsa logs and export in a lookup. then use the lookup that will not need any dates.

[somesoni2]

What is your current search? Could you provide more details on what you expect your search to do? Sample events from both will be great.