All Apps and Add-ons

juniper netscreen (screenos) traffic log report

tmichiels
Explorer

Hi does anyone has experience with creating a report from a Juniper Netscreen (ScreenOS) traffic log?

My customer needs a report with all unique IP's and their received and their sent data during a specific period. Any idea how to do this ?

Furthermore is it possible to add names to these IP's ?

thx

Tags (3)

hazekamp
Builder

tmichels,

A sample would go along way in terms of providing configuration details, but I can speak in generalities.

  1. Splunk can easily extract both src/dest IP and calculate unique (distinct) counts for these extracted fields. For example: | stats dc(src_ip) as unique_src_ips
  2. It is possible to add additional information based on an IP Address lookup. The integration depends on your data source. Is this information in a CSV? If yes, you can use a standard Splunk lookup. If it's accessible via an API or DB, you can use a scripted (custom) lookup
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...