Getting Data In

Multiple hosts with two interesting fields

alexrod03
New Member

Hi, I am trying to bring back two interesting fields from multiple hosts. My search looks like this.

index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4) c_ip=Range OR Client_IP=Range

This search is only bringing back c_ip results not Client_IP results. It should be bringing back both.

Tags (1)
0 Karma

alexrod03
New Member

I think I may have figured it out.

index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4)
| eval theIP=if(isnull(Client_IP), c_ip, Client_IP)
| eval isExternal=if(cidrmatch("192.0.0.0",theIP), "internal", "external")
| stats count AS "Total" by isExternal, host
| where isExternal="external" AND Total <30

0 Karma

to4kawa
Ultra Champion
index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4) c_ip="192.0.0.0/8" OR Client_IP="192.0.0.0/8"

Searching accepts CIDR prefix.

but your first search doesn't have Client_ip result.

 index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4) 
| stats count by Cleint_IP

What's this result? Is there ip addresses within 192.0.0.0/8?

0 Karma

woodcock
Esteemed Legend

Try running your search in verbose mode or add something like this to the end to force other modes to handle the fields:

... | fillnull value="<MISSING>" c_ip results Client_IP
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexrod03,
at first use the Parenthesis also in the second part of the main search:

index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4) (c_ip=Range OR Client_IP=Range)
| ...

then check if you have events with this field: you can check this running a search without the last part and see in the interesting fields if there's this field, eventually enlarging the time period.

Ciao.
Giuseppe

0 Karma

alexrod03
New Member

Hi @gcusello thanks for that. My end result would be to figure out which hosts are sending only internal address for a 24 hour period. These hosts send both internal and external address in the c_ip and Client_IP field.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexrod03,
Sorry but I don't understand your need:
you have the destination IP in field c_ip or in field Client_IP
i think that you're using an internal IP addressing different than the external,
Is this correct?
If yes, you could use this IP addresses to filter your logs in both the fields.

If the addresses are too many, you could put them in a lookup and use it to filter your logs.

Ciao.
Giuseppe

0 Karma

alexrod03
New Member

So these hosts send internal and external IP address in the c_ip and Client_IP field. Is there a way to filter out which hosts are only sending internal address for a 24 hour period?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexrod03,
is there an IP addressing plan in your company (e.g. all the internal addresses start with 10: e.g. 10.x.x.x)?
If not, the only way is to have a list of internal IP ranges (in a lookup or from another search) and use it to filter events.

Ciao.
Giuseppe

0 Karma

alexrod03
New Member

Yes there is an internal range. So in essence c_ip=InternalRange OR Client_IP=InternalRange. But I want to alert when c_ip or Client_IP are ONLY sending internal range for 24 hour period. Normally c_ip and Client_IP send a mixture of and internal range and external IP's. Hopefully this makes sense.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexrod03,
yes now it more clear:
you have to distinguish internal from external ranges,
try something like this:

index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4)
| eval ip=coalesce(c_ip,Client_IP)
| eval kind=if(ip=Internal_Range,"Internal","External")
| stats values(kind) AS kind BY host
| where kind=Internal

Ciao.
Giuseppe

0 Karma

alexrod03
New Member

I am getting an error. Error in 'eval' command:The number "range" is invalid

0 Karma

gcusello
SplunkTrust
SplunkTrust

have you single IPs or IP ranges?
Ciao.
Giuseppe

0 Karma

alexrod03
New Member

Doing a range. Example 192.0.0.0/8

0 Karma

gcusello
SplunkTrust
SplunkTrust

try with quotes, e.g. "10.0.0.0/8":

index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4)
| eval ip=coalesce(c_ip,Client_IP)
| eval kind=if(ip="10.0.0.0/8","Internal","External")
| stats values(kind) AS kind BY host
| where kind=Internal

Ciao.
Giuseppe

0 Karma

alexrod03
New Member

That worked no errors but no results. So basically I want know if one of those hosts is only sending 192.0.0.0/8 ip's under the c_ip and Client_IP field.

0 Karma

gcusello
SplunkTrust
SplunkTrust

To debug, choose an IP that is surely present and check if the search gives results.
If yes try with star (e.g.: "10.0.0.*")
if not, use the first two rows and see which values there are in the ip field, probably this is the problem.

Ciao.
Giuseppe

0 Karma

alexrod03
New Member

So I have this query but it's not showing the hosts I know for a fact are only sending internal IP's. If I remove the other hosts and only keep the one that is sending internal IP's it works.

Index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4
| eval theIP=if(isnull(Client_IP), c_ip, Client_IP)
| eval isExternal=if(cidrmatch("192.0.0.0/8",theIP), "internal", "external")
| stats count AS "Total" by isExternal, host
| where isExternal="external" AND Total <0

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...