Splunk Search

Filtering Fields

wrays
New Member

host=server sourcetype=iis src_ip=* NOT src_ip="x.x.x.x"

This Search gives me some very helpful information - but regarding the URL, I get the url information and lots of compatibility information which I want to filter out. I am unable to accomplish this so far. Any suggestions?

Tags (1)
0 Karma

antlefebvre
Communicator

If you are just looking for source ip at the end of your search pipe into a table.

host=server sourcetype=iis src_ip=* NOT src_ip="x.x.x.x" | table _time src_ip

This will give you just the time and source IP of the events.

also if you use the dedup command you will get just a list of unique source IP addresses as a list.

 host=server sourcetype=iis src_ip=* NOT src_ip="x.x.x.x" |dedup src_ip | table src_ip | sort -src_ip

lukejadamec
Super Champion

The IIS fields you are looking for are (should) already be available. From your original search which gives you all the data look on the left side of the screen.
The field list should contain fields like: c_ip, cs_bytes, cs_method, cs_Referer_, cs_uri_query cs_uri_stem, etc... If you don't see them, then select Show All Fields at the bottom of the list.
Just add the fields you want to your table.

0 Karma

antlefebvre
Communicator

If the field doesn't already exist you will need to create an extraction. Next to the event click the arrow on the left hand side and in event actions select extract fields. You can then give some examples that you want to extract. Then save the extraction as some field name. Now you can add your field name to the search above and get the extraction for the web get request.

0 Karma

wrays
New Member

Thanks for the information. Being new to the search format, that was most helpful. The only other field I need to extract would be like the example that follows:

Request (GET:https://website.website.com:443/ntwkcntr/NCC%20MGMT/_w/Elvis%20Presley_jpg.jpg)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...