Getting Data In

Monitoring of UF Connectivity on port 9997 to Non Splunk Destinations

mel_arce
Engager

Hi  There,
 

  Good day , 

Is there a SPL based set up to look for UF connectivity on port 9997 to Non Splunk Destinations.
And is there any documentation in splunk finding what IP addresses splunk cloud uses or if splunk has allocated IP address range.

Thanks in advance for the help and support.

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your firewall and/or network monitoring tools report connection into Splunk then it should an easy matter to query for connections to dest_port=9997 and dest_ip!=*.splunkcloud.com.

Splunk Cloud does not publish IP addresses.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mel_arce
Engager

Thanks Richgalloway for the updates, appreciate it.  However, I’m not quite sure what is the dest_ip in the sample logs I gathered so far. Can you check and confirm if the dest_ip in the sample internal logs is same as the lastIndexer field as I do not see dest_ip field in my sample SPL query below:

Search:  index=_internal source=*metrics.log* group=tcpin_connections os=* uf destPort=9997

Sample Result (IP value masked):
01-27-2022 15:23:05.555 +0000 INFO  Metrics - group=tcpin_connections, ingest_pipe=1, zz.zz.zz.zz:54598:9997, connectionType=cookedSSL, sourcePort=54598, sourceHost=zz.zz.zz.zz, sourceIp=zz.zz.zz.zz, destPort=9997, kb=11.879, _tcp_Bps=391.929, _tcp_KBps=0.383, _tcp_avg_thruput=0.829, _tcp_Kprocessed=30.397, _tcp_eps=0.580, _process_time_ms=0, evt_misc_kBps=0.000, evt_raw_kBps=0.290, evt_fields_kBps=0.032, evt_fn_kBps=0.000, evt_fv_kBps=0.032, evt_fn_str_kBps=0.000, evt_fn_meta_dyn_kBps=0.000, evt_fn_meta_predef_kBps=0.000, evt_fn_meta_str_kBps=0.000, evt_fv_num_kBps=0.000, evt_fv_str_kBps=0.032, evt_fv_predef_kBps=0.000, evt_fv_offlen_kBps=0.000, evt_fv_fp_kBps=0.000, build=06d57c595b80, version=7.2.3, os=Linux, arch=x86_64, hostname=abc.com, guid=B6BDE37F-7F82-465F-9393-88C586D69485, fwdType=uf, ssl=true, lastIndexer="xx.xx.xx.xx:9997,yy.yy.yy.yy:9997", ack=false

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That event is neither a firewall nor a network device event.  It's reported by a Splunk instance when it receives data on a TCP connection.  It doesn't address the question of UFs sending to non-Splunk servers.

The UF should be logging its connections.  Try

index=_internal sourcetype=splunkd host=foo TcpOutputProc
---
If this reply helps you, Karma would be appreciated.

mel_arce
Engager

Thank you Richgalloway. Will try this and will check the outputed results, will keep you posted then. Appreciate much for you kind assistance.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...