Getting Data In

Using field values in a bash script

xureal
New Member

Hello,

I'm trying to write a shell script in response to attempted ssh logins from multiple IP addresses. I have used rex to create a username field in my search since splunk couldn't grab the data itself, and was wondering if there is any way of passing the value of the field into my shell script.

My search:
eventtype=ssh-login-attempt | rex field=_raw "User '(?\w+)"

I'm looking to get the value of the username field into my shell script.

Tags (2)
0 Karma

dcparker
Path Finder

Did you get anywhere with this? I'm starting to explore the same thing. Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Depending on what you're trying to achieve, your script could call the query through a splunk API such as the REST one.

Alternatively, you could trigger your script from a splunk alert and then pick up the results.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

When you're running the query as an alert already you should look into passing the results to a script called by an alert - http://docs.splunk.com/Documentation/Splunk/5.0.1/alert/ConfiguringScriptedAlerts

0 Karma

xureal
New Member

Thanks for the response. Just had a quick scroll through the REST API, not sure if that's what I'm looking for, however I will have a better read 'morrow when I wake up.

Just to clarify, the search will pick out users that try to ssh into the server from more than one ip address.

So for instance if the user 'andy' tries to ssh in from 192.168.0.2 and 192.168.1.5 the alert will fire off. What I'm trying to do is pass the value of the username, in this case 'andy', to the script, so that I could for example change the motd on the router to something like " Andy tried to login from 2 IPs "

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...