Splunk Search

Concatenate events from FTP log to produce UserID list of successful logins

bwhyle
Engager

My goal is to create a search that produces a report of ftp users that have logged in (successfully) in the past 7 days. My issue is that each FTP command is a separate event and the common link is the session ID. I've created fields of each piece of information I need to evaluate (UserID, SessionID, ftpcommand) but I'm not sure how to pull them all together as one event using the sessionID to create the table of users with the last login timestamp. (I know the 230 after PASS indicates a successful login)

Sample log entries:
23:59:59 10.1.2.3 [805910]PASS - 230 0 0 0 1531
23:59:57 10.1.2.3 [805910]USER user123 331 0 0 0 0

create UserID Field
rex "(?i)^[^USER]*USER(?P.+?)\s+\d+"

create SessionID field
rex "(?i) (?P[\d+])C"

Create ftpcommand field
rex "(?i)^[^]]*](?P[^ ]+)"

Any feedback or direction is appreciated.

Tags (2)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi bwhyle,

based on your provided example you could use something like this:

your base search here 
| transaction "sessionid" startswith="USER" maxspan=1min
| stats last(_time) AS "last login time" by userid, ftpcommand, sessionid

the transaction will use the sessionid to build the events, the events will start at the USER and lasts for a maximum of 1 minute. The stats is used to do the output you want.
Adapt it to your needs and you're done.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi bwhyle,

based on your provided example you could use something like this:

your base search here 
| transaction "sessionid" startswith="USER" maxspan=1min
| stats last(_time) AS "last login time" by userid, ftpcommand, sessionid

the transaction will use the sessionid to build the events, the events will start at the USER and lasts for a maximum of 1 minute. The stats is used to do the output you want.
Adapt it to your needs and you're done.

Hope this helps ...

cheers, MuS

ppablo
Community Manager
Community Manager

Hi @bwhyle

Glad you got your issue solved! Please be sure to accept @MuS's answer by clicking on the check mark next to his response. People with similar issues will look to this post for help aand you both get karma points too 🙂

Patrick

0 Karma

bwhyle
Engager

Brilliant, thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...