Splunk Search

Create Multi-Value field based 4 fields

jachockey012
Explorer

So basically I have some network logs and by base search filters down to source IP, destination IP, destination port, and protocol. I am trying to figure out a way to iterate over all events and group based off the 4-tuple data mentioned above. Below is an image of what I am thinking. You'll notice I added an ID field and I figured that would somehow be the equivalent to  ID+=1 at the end of a loop or something. 

 

 

spl-help.PNG

 

The original data is bro logs. If you need a list of all the fields below is a link and the source is the conn.log (the green box on the first page)
http://gauss.ececs.uc.edu/Courses/c6055/pdf/bro_log_vars.pdf 

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
Legend
| eval tuple='src-ip'.'dst-ip'.'dst-port'.'proto'
| stats list(src-ip) as src-ip list(dst-ip) as dst-ip list(dst-port) as dst-port list(proto) as proto by tuple
| streamstats count as id
| fields - tuple

View solution in original post

ITWhisperer
Legend
| eval tuple='src-ip'.'dst-ip'.'dst-port'.'proto'
| stats list(src-ip) as src-ip list(dst-ip) as dst-ip list(dst-port) as dst-port list(proto) as proto by tuple
| streamstats count as id
| fields - tuple

View solution in original post

jachockey012
Explorer

Effective... Thank you very much. 

0 Karma