Splunk Enterprise

Splunk Enterprise - Whois Query by variable not working help

pstorms
New Member

Hello,

I am a newbie to splunk and am trying to get a dashboard going to query whois and return information related to security concerns.   I am tracking on my Linux email host authorization failed messages in syslog.   I would like to take the ip address and determine, to start, where this host is located in the world based upon the asn_country_code.   If I do a query where I use just the IP address it works.  But when I try to use a variable, it fails.  I have tried searching long and hard and cannot find the answer.  When I use the addon app "Network Toolkit" it has a function whois contained, it has many attributes when an ip or domain name is provided as the search string.  One key element is rhost or asn_country_code, which I am currently interested in using.  

When I run the query:

(index=* OR index=_*) "authentication failure"
| eval country_code = [| whois 14.177.64.163 | search attribute=asn_country_code | stats values(value) as country | eval search="\"".mvjoin(country, ",")."\"" ]
| table rhost, country_code

 

I get the following results:

pstorms_0-1615417243394.png

 

This is just so it works.  I get the ip addresses of the hosts that failed their authentication request.   But the country code is manually entered and i get only the "VN" response, just troubleshooting the query so it works.   I'd like to get the appropriate country code from whois, but when I change the ip address from "14.177.64.162" to rhost, it fails the query.

(index=* OR index=_*) "authentication failure"
| eval country_code = [| whois rhost | search attribute=asn_country_code | stats values(value) as country | eval search="\"".mvjoin(country, ",")."\"" ]
| table rhost, country_code

 

I get the following:

pstorms_1-1615417369933.png

What am I doing wrong with the variable attribute rhost?   Does it need to be in quotations?  (tried) or?   I am at a loss.   Can someone guide me to the right answer?

Thank you very much.

 

 

 

 

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...