ASA searching for current open connections that have been Built but with no teardown

[FC50]

Hello,

I'm pretty new to SPLUNK and I'm looking for help trying to find ASA open connections between two endpoints.

Most connections I search for have a 'Built' action and then some time after a corresponding 'teardown' action. I'm looking for those connections that have the 'Built' action  but not the 'teardown' action.

The basic search I have pulls down all of the connections between the two:. 

index="cisco" src_ip="10.55.45.12" dest_ip="10.65.45.20" dest_port=445

Is there a way to expand this search to find  these open connections based on the absence of a teardown?  

Is there a way to 

[FC50]

Cool, thanks. That seems to have done the trick

[richgalloway]

Here's one way to do that.

index="cisco" src_ip="10.55.45.12" dest_ip="10.65.45.20" dest_port=445
| dedup session,action
| where action="built"

It assumes there is a field called "session" that uniquely identifies a connection between the two points.  Change that to match whatever you have in your data.

[FC50]

Thanks for the response but no joy unfortunately.

It's still bringing up the thousands of results with the allowed action (I mistakenly called it built earlier) , and not showing just the few that only had the allowed action and not a corresponding teardown.

The allowed and teardown options do share a field called 'session_id' which is a long number

[richgalloway · Accepted solution]

I've tweaked my answer to only look for allowed and teardown actions and then leave only those sessions with the most recent action of "allowed".