Pull a specific event from Splunk

[viay32]

We have a portal that is used by the SOC for malware investigations. The portal has the ability to login to Splunk & conduct searches.

How can I generalise the search to match the particular event. For example:

Source IP: A.B.C.D
Target IP: D.E.F.G
Date & Time: 22/02/2017 14:00

Our aim is to pull the specific event from Splunk.

The IP & date/time will change for each event.

Thanks heaps.

[martin_mueller]

You're probably looking for a dashboard with form inputs?

If so, create inputs for the source ip, target ip, and a time range picker. Then use a search something like this:

index=foo sourcetype=bar src="$src_token$" dest="$dest_token$"

Configure the search to use the time range picker.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms

[viay32]

Thanks heaps martin_mueller. I will test this out.