We have a portal that is used by the SOC for malware investigations. The portal has the ability to login to Splunk & conduct searches.
How can I generalise the search to match the particular event. For example:
Source IP: A.B.C.D
Target IP: D.E.F.G
Date & Time: 22/02/2017 14:00
Our aim is to pull the specific event from Splunk.
The IP & date/time will change for each event.
Thanks heaps.
You're probably looking for a dashboard with form inputs?
If so, create inputs for the source ip, target ip, and a time range picker. Then use a search something like this:
index=foo sourcetype=bar src="$src_token$" dest="$dest_token$"
Configure the search to use the time range picker.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms
Thanks heaps martin_mueller. I will test this out.