Splunk Dev

Pull a specific event from Splunk

viay32
New Member

We have a portal that is used by the SOC for malware investigations. The portal has the ability to login to Splunk & conduct searches.

How can I generalise the search to match the particular event. For example:

Source IP: A.B.C.D
Target IP: D.E.F.G
Date & Time: 22/02/2017 14:00

Our aim is to pull the specific event from Splunk.

The IP & date/time will change for each event.

Thanks heaps.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for a dashboard with form inputs?

If so, create inputs for the source ip, target ip, and a time range picker. Then use a search something like this:

index=foo sourcetype=bar src="$src_token$" dest="$dest_token$"

Configure the search to use the time range picker.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms

0 Karma

viay32
New Member

Thanks heaps martin_mueller. I will test this out.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...