Archive

Pull a specific event from Splunk

New Member

We have a portal that is used by the SOC for malware investigations. The portal has the ability to login to Splunk & conduct searches.

How can I generalise the search to match the particular event. For example:

Source IP: A.B.C.D
Target IP: D.E.F.G
Date & Time: 22/02/2017 14:00

Our aim is to pull the specific event from Splunk.

The IP & date/time will change for each event.

Thanks heaps.

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

You're probably looking for a dashboard with form inputs?

If so, create inputs for the source ip, target ip, and a time range picker. Then use a search something like this:

index=foo sourcetype=bar src="$src_token$" dest="$dest_token$"

Configure the search to use the time range picker.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms

0 Karma

New Member

Thanks heaps martin_mueller. I will test this out.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!