Counting and threasholding

[kyoshiike]

Folks,

I'm new to SPL worlds. Please advice right direction to learn splunk search.

Environment: proxy log search

Situation: Some clients sent massive HTTP request in a small period of time to various destinations. (I doubt this clients are infected by malware)

How can I find this client by Splunk search with proxy or firewall log?

transaction command will help to find how many sessions generated by single IP, but I don't know next steps. 

[kyoshiike]

I already checked this tutorial. However it didn't provide right answer for my question...

I want to know good index to search from objective to right comamnds.

Is it only way to search docs.splunk.com with related words manually?

[gcusello · Accepted solution]

Hi @kyoshiike,

at first you have to identify the indexes where proxy and firewall logs are stored.

then you have to identify the key )e.g. src or src_ip to correlate events.

The transaction command is a command to use only in defined situations because it's a very slow command, it should be used only when you haven0t fields to use as correlation keys and you must use startswith and(or endswith strings to correlate events.

In your case, you could use stats, see my approach and adapt to your requirement:

index=firewall OR index=proxy
| stats 
   dc(dst_port) AS dst_port_count
   dc(dst) AS dst
   BY src

in this way you know id a src is calling more destinations or more ports.

Anyway, the approach is to put all in the main search and use the correlation key in a stats command, identifying what to search.

The options to use in the stats command are many, for this reason I hinted to follo the Splunk Search Tutorial.

ciao.

Giuseppe

[gcusello]

Hi @kyoshiike,

if you don't knoe SPL, follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial9 that helps you to understand how to search in Splunk.

In community there are many answers (also from me) listing all the free trainings that you can follow to use SPL.

Ciao.

Giuseppe