Splunk Enterprise Security

How to group similar events into one event

callumring
New Member

Hi,

We have pulled logs from our Anti Virus software into splunk and are in process of trying to filter through what we actually want to track.

We want to track all events that relate to sites blocked for particular reasons EG:
'https://ads.converge-digital.com' blocked due to category 'Proxies & Translators'

We have a lot of different sites that are being blocked in the same way, so is there a way to group these all together so we can see everything that has been blocked by 'Proxies and Translators' as opposed to sifting through each individual event?

Thanks

0 Karma

wmyersas
Builder

You'll want to use |stats for this. Something like this:

index=ndx sourcetype=av domain=* blockedreason=*
| stats values(domain) as "Domains Blocked" by blockedreason
| rename blockedreason as "AV Policy Violation"

See https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Stats for mroe details on what kinds of statistical functions you might want to use

callumring
New Member

So it seems as thought I can rename the title using this, but not the actual event that I want to group together.

It isnt the actual heading I want to rename and group, rather the list of all events that fall into that field. EG:
rename name='*' blocked due to category 'Advertisements & Pop-Ups' as "Blocked events - Advertisments and Pop Ups"
This will not work as it will not allow me to rename the whole event, just the heading (name) that it comes under.

0 Karma

wmyersas
Builder

I'm fairly certain the example I provided is still what you're describing: it'll group all the blocked domains by the reason they're blocked (of course, substitute actual field names vs the example)

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...