Splunk Enterprise Security

How do you show only specific categories in returned events?

markerton
New Member

I'm trying to run a simple search that shows only specific results and excludes the rest.

The results are coming from our proxy and I only want to show two categories: Malnets or Botnets; however when running the search it populates the results with additional categories (such as Health, Shopping, Technology, etc.). As it's going to be used in a dashboard, I only want to show the two intended categories and exclude the rest.

(I'm fairly new to Splunk so my knowledge is not very vast.)

The search I have so far is:

index=proxy category="*botnets" OR category="*malnets" | chart count by category | sort -count

I've tried searching around and trying a few other commands (like useother but can't seem to get it to work out how I want it.

Thanks in advance for any help.

0 Karma

zonistj
Path Finder

Hi! My best guess is that your proxy events have multiple categories per event. So, for example, a given event might have two categories: "malnets" and "shopping". That would make sense given that websites / traffic can fall into multiple categories.

Is there a unique ID for each event? If so, I recommend running something like this:

 index=proxy category="*botnets" 
|stats dc(category) values(category) by event_id

The intent here is to validate if you have multiple categories per event. The stats function is going to give you a count of how many unique categories as well as a listing of the unique category values per event. If you have a count larger than one and multiple categories listed in a given event then that confirms why you're seeing more categories than expected.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...