Best way to find destination IPs that become source IPs?

[jbreeves]

Hi, 

I'm attempting to build a query to find destination IP addresses that became source IPs for traffic in a 5min window.  What is the best way to do this? Given that it's IDS data, I don't think a join with subsearch would be good because of the 10,000 record limitation and the map function takes forever just looking at 15mins worth of data. 

Any ideas or help is greatly appreciated!

[PickleRick]

You have to untable your results.

<your_search> 
| fields _time src dst
| untable _time end ip
| sort 0 _time
| streamstats values(end) as end by ip time_window=5m
| search end=s end=d

There is one caveat though. Even though the time window is expressed with a time value it still has to fit within the global max_stream_window limit (10k rows by default).

[PickleRick]

But you can get around this limitation.

After the sort do

| streamstats latest_time(eval(if(end="d",1,null()))) as lastd by ip
| where end="s" and _time-lastd<300

I'm not sure if I didn't sort the wrong way or did the time comparison the wrong way around. But you should get the idea.

[scelikok]

Hi @jbreeves,

You can try with a subsearch using stats to limit results like below;

index=ids 
    [ index=ids 
    | stats count by dest_ip 
    | fields dest_ip 
    | rename dest_ip as src_ip ] 
| stats count by src_ip