Splunk Search

How do I sort and get a count for specific data?

sean_kirkpatric
Engager

I have the following search for my Cisco ASA

event_desc="Deny TCP (no connection) from IP_address/port to IP_address/port flags tcp_flags on interface interface_name."

How can I sort this search on the "to IP_address/port" and get a count of each?

Thanks

SK

Tags (4)
0 Karma
1 Solution

rturk
Builder

Hi Sean, try the following:

<base search> | rex field=event_desc "to (?<dst_ip_address>\d+\.\d+\.\d+\.\d+)/(?<dst_port>\d+)" | stats count by dst_ip_address, dst_port

If this doesn't work, if you could post an actual event I might be able to fine tune it for you.

Hope this helps 🙂

View solution in original post

0 Karma

sean_kirkpatric
Engager

Got it... I was missing a ? before . Thanks!

0 Karma

rturk
Builder

Glad I could help 🙂

0 Karma

rturk
Builder

Hi Sean, try the following:

<base search> | rex field=event_desc "to (?<dst_ip_address>\d+\.\d+\.\d+\.\d+)/(?<dst_port>\d+)" | stats count by dst_ip_address, dst_port

If this doesn't work, if you could post an actual event I might be able to fine tune it for you.

Hope this helps 🙂

0 Karma

sean_kirkpatric
Engager

Thanks. I removed field=event_desc, and I still get the matching events but no results found.

I have the Firewall app, but it doesn't give me all the info I need.

0 Karma

rturk
Builder

Ahhh... well in that case get rid of field=event_desc and you should be good.

Also, seeing as you're dealing with ASA logs, you might find the "Splunk for Cisco Firewalls" and "Cisco Security Suite" apps worth a look.

sean_kirkpatric
Engager

Thank you for you help. Unfortunately, the results come out empty. Splunk says it finds 1900+ matches though. Here is an actual event.

Sep 23 18:14:15 10.10.10.1 Sep 23 2013 18:16:15: %ASA-6-106015: Deny TCP (no connection) from 15.16.17.8/80 to 12.22.12.1/1398 flags FIN PSH ACK on interface outside

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...