How do I run a splunk query to find traffic activities on a specific host name

[coulouteg]

Hello, I am trying to figure out how to run a query in my splunk environment to find all the traffic activities of a specific host on a specific date. for example, if the host name is "abc" and I need to know if they made a connection to host "xyz" on oct, 1, 2019.

Can you someone please show me how to do this. any assistance would be greatly appreciated.

I look forward to your response.

Thanks,

Cosmo.

[_smp_]

A lot of this depends on the details of your Splunk implementation. For example, your index and field names might not be the same as mine.

Does your index contain connection events? Is there a field to represent the source and destination of a connection? Is it a name or IP address?

In my case, our firewall index has source IPs and destination IPs so my query would look like this:

index=firewall src_ip="abc" dest_ip="xyz" earliest="10/1/2019:00:00:00" latest="10/1/2019:23:59:59"