Getting Data In

How can I correlate firewall traffic from two different timestamps

matthewg
Explorer

I want to get a list of traffic that has accessed the same site at two different times. All I know are the times: say 10:00 AM and 11:30 AM.
How can I get a list of events where an internal IP connected to the same external IP at or near both times. I don't know either of the IP's I simply want to find a list of connections that were active at both times.

  • earliest="(date and time)" latest="(date and time)" AND earliest="(date and time)" latest="(date and time)"
0 Karma

pradeepkumarg
Influencer

Increase your time range to cover both the time frames and search for something like below

Assuming your field names are internal_ip external_ip

index=your_index earliest=your_earliest_time latest=your_latest_time | stats count, values(_time) by internal_ip,external_ip | search count > 1

This will result in the events where the combination of internal_ip and external_ip occurred more than once along with the time of access

0 Karma

matthewg
Explorer

But what if I have hundreds or thousands of combinations of internal and external ips that connected multiple times in between those times but I want to filter to the ones close to those two time intervals?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!