Getting Data In

splunk --filtering and corelation

ritikaviavi
Observer

We are having NPS auth logs from our VPN service.
Requirement : In NPS logs first when auth request come in it gets logged under Packet_Type=1 and upon rejection of auth request it gest logged with Packet_Type=3 , client IP do only come & get marked under field calling_station_id with Packet_Type=1, username gets marked under both packet_type (1 & 3) , I need to filter out events having either packet_type =1 and packet_type=3 but same username and extract field calling_station_Id, after that to further find if same set of event happening for different username from same calling_station_id.
example log:
Packet_Type=1 for username ABC123
2016-03-28T07:30:47.960 id=5296293 Computer_Name=XXXX Packet_Type=1 User_Name=ABC123 F_Q_User_Name="ABC123" Called_Station_Id=1.1.1.1 Calling_Station_Id=1.2.3.4 Callback_Number=
Framed_IP_Address= NAS_Identifier= NAS_IP_Address=5.6.7.8 NAS_Port=74940416 Client_Vendor=9 Client_IP_Address=5.6.7.8 Client_Friendly_Name=corp Event_Timestamp=
Port_Limit= NAS_Port_Type=5 Connect_Info= Framed_Protocol=

Packet_type=3 for same username ABC123
2016-03-28T07:30:47.967 id=5296294 Computer_Name=xxxx Packet_Type=3 User_Name= F_Q_User_Name="ABC123" Called_Station_Id= Calling_Station_Id=
Callback_Number= Framed_IP_Address= NAS_Identifier= NAS_IP_Address= NAS_Port= Client_Vendor=9 Client_IP_Address=5.6.7.8 Client_Friendly_Name=corp
Event_Timestamp= Port_Limit= NAS_Port_Type= Connect_Info= Framed_Protocol= Service_Type= Authentication_Type=4 NP_Policy_Name=
Reason_Code=16 Class="311 1 5.4.3.1 07/24/2016 20:10:56 138735" Session_Timeout=
Service_Type= Authentication_Type=4 NP_Policy_Name= Reason_Code=0 Class="311 1 5.4.3.2 07/24/2016 20:10:56 138735"

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try (username is already extracted as field)

your base search to select both Packet_type=1 and Packet_type=3 logs
| stats values(Calling_station_id) as Calling_station_id dc(Packet_type) as Packet_types by username
| where isnotnull(Calling_station_id) AND Packet_types =2
| stats values(username) as usernames by Calling_station_id
| where mvcount(usernames)>1

This will give list of Calling_station_id where both Packet_type=1 and Packet_type=3 events happened from multiple users.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try (username is already extracted as field)

your base search to select both Packet_type=1 and Packet_type=3 logs
| stats values(Calling_station_id) as Calling_station_id dc(Packet_type) as Packet_types by username
| where isnotnull(Calling_station_id) AND Packet_types =2
| stats values(username) as usernames by Calling_station_id
| where mvcount(usernames)>1

This will give list of Calling_station_id where both Packet_type=1 and Packet_type=3 events happened from multiple users.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...