Archive
Highlighted

Pull a specific event from Splunk

New Member

We have a portal that is used by the SOC for malware investigations. The portal has the ability to login to Splunk & conduct searches.

How can I generalise the search to match the particular event. For example:

Source IP: A.B.C.D
Target IP: D.E.F.G
Date & Time: 22/02/2017 14:00

Our aim is to pull the specific event from Splunk.

The IP & date/time will change for each event.

Thanks heaps.

Tags (1)
0 Karma
Highlighted

Re: Pull a specific event from Splunk

SplunkTrust
SplunkTrust

You're probably looking for a dashboard with form inputs?

If so, create inputs for the source ip, target ip, and a time range picker. Then use a search something like this:

index=foo sourcetype=bar src="$src_token$" dest="$dest_token$"

Configure the search to use the time range picker.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms

0 Karma
Highlighted

Re: Pull a specific event from Splunk

New Member

Thanks heaps martin_mueller. I will test this out.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.