Getting Data In

Using Cisco ACS command logging, find one line then a related line

splunkmduser
New Member

Cisco ACS logging find CmdAV=interface and then next successful command from same user with CmdAV=no CmdArgAV=shutdown CmgArgAV=. I've been using transaction, but don't seem to be able to figure out quite how to go about find this information.

Ultimately, I am trying to find out when a no shutdown command on an interface is successfully run - but I need to know the interface it was run on.

Thanks!

0 Karma

Richfez
SplunkTrust
SplunkTrust

splunkmduser,

I'm just guessing at an answer here, but perhaps this guess will either get you where you need to be or might at least help clarify the situation.

First, you have to make sure "interface" is an output field already. If it isn't already available, that's a different task to identify and output that (not terribly hard, but needs more info than what's given).

As long as you have that as an output field already, a possible transaction command may be something using the startswith= and endswith= parameters sort of like so:

mysearchhere | transaction startswith="CmdAv=interface" endswith="CmdAV=no AND CmdArgAV=shutdown AND CmdArgAv=." by user

Then, once you have the transaction set up - you could probably just pipe it to a table to make it pretty: | table _time, user, CmdArgV, interface or something similar.

See if that doesn't get you started!

0 Karma

splunkmduser
New Member

Thanks! That got me much closer. My reference material didn't indicate that I could specify a variable within the startswith and endswith command, much last AND two conditions.

That gives rise to even more questions.

How do I remove any transaction that contains CmdAV=shutdown? That is, a shutdown command was run before the no shutdown (CmdAV=no CmdArgAV=shutdown).

In a table, how do a show all values for a repeated variable? The interface command looks like this: CmdAV=interface CmdArgAV=Gigabit CmdArgAV=2/1. Repeating CmdArgAV in the table command does not give me all the arguments.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...