Security

How do I find the first firewall entry?

nick598660
New Member

Hello Everyone,

I need some help figuring out how far back my firewall logs go. If I set the time picker to "All Time", and just search for Cisco ASA, I get 20 pages of events from today.

Any ideas on how I can locate when I first started getting logs into Splunk from my firewall?

Tags (2)
0 Karma
1 Solution

whrg
Motivator

Hello @nick598660,

You can use the metadata command to list the timestamps of the first event and of last the event for a list of sourcetypes/hosts/sources.

Try something like this:

| metadata type=sourcetypes index=YOURINDEX
| rename firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update"
| fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")

The web page under Settings / Indexes also lists the earliest event and the latest event for each index.

If the log volume is not too big, then you could also run a simple tail command to retrieve the first event. Set the time picker to "All Time":

index=YOURINDEX sourcetype=YOURSOURCETYPE | tail 1

View solution in original post

0 Karma

whrg
Motivator

Hello @nick598660,

You can use the metadata command to list the timestamps of the first event and of last the event for a list of sourcetypes/hosts/sources.

Try something like this:

| metadata type=sourcetypes index=YOURINDEX
| rename firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update"
| fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")

The web page under Settings / Indexes also lists the earliest event and the latest event for each index.

If the log volume is not too big, then you could also run a simple tail command to retrieve the first event. Set the time picker to "All Time":

index=YOURINDEX sourcetype=YOURSOURCETYPE | tail 1
0 Karma

nick598660
New Member

That is exactly what I was looking for. Thank You!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...