Splunk Enterprise Security

Add fields to tstat results

girtsgr
Explorer

Hi!

I want to use a tstats search to monitor for network scanning attempts from a particular subnet:

| tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16   by All_Traffic.src 
| sort - dest_count 
| where dest_count > 70 

My index2 contains IP addresses and users (src_ip, user and event contains text string "LOCAL") that I would like to match with the All_Traffic.src IP addresses, so I would get the last user name that used the particular All_Traffic.src in the results. I have tried both join and map with no success:

| tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16   by All_Traffic.src 
| sort - dest_count 
| where dest_count > 70 
| rename All_Traffic.src AS src_ip
| join type=left src_ip 
    [search index=index2 "LOCAL" 
    | head 1 
    | fields src_ip user ] 
| table All_Traffic.src dest_count user

join returns All_Traffic.src and dest_count without users.

| tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16   by All_Traffic.src 
| sort - dest_count 
| where dest_count > 70 
| rename All_Traffic.src AS srcip
| map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 | fields user" 
| table All_Traffic.src dest_count user

map returns users, but no All_Traffic.src and dest_count

What is the correct way to get the results I need?

Thank you.

0 Karma
1 Solution

HiroshiSatoh
Champion
 | map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 | fields user" 
 →
 | map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 |eval dest_count =$dest_count$ | fields src_ip dest_count user" 

View solution in original post

0 Karma

HiroshiSatoh
Champion
 | map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 | fields user" 
 →
 | map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 |eval dest_count =$dest_count$ | fields src_ip dest_count user" 
0 Karma

girtsgr
Explorer

Can you post this as an answer, so I can mark it as the correct one? I don't have the option to do this on a comment. Thanks 🙂

0 Karma

girtsgr
Explorer

This works, thank you very much!

0 Karma

to4kawa
Ultra Champion
| table All_Traffic.src dest_count user
→
| table src_ip dest_count user

you renamed the field.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...