Splunk Search

How do I sort and get a count for specific data?

I have the following search for my Cisco ASA

event_desc="Deny TCP (no connection) from IP_address/port to IP_address/port flags tcp_flags on interface interface_name."

How can I sort this search on the "to IP_address/port" and get a count of each?

Thanks

SK

Tags (4)
0 Karma
1 Solution

Builder

Hi Sean, try the following:

<base search> | rex field=event_desc "to (?<dst_ip_address>\d+\.\d+\.\d+\.\d+)/(?<dst_port>\d+)" | stats count by dst_ip_address, dst_port

If this doesn't work, if you could post an actual event I might be able to fine tune it for you.

Hope this helps 🙂

View solution in original post

0 Karma

Got it... I was missing a ? before . Thanks!

0 Karma

Builder

Glad I could help 🙂

0 Karma

Builder

Hi Sean, try the following:

<base search> | rex field=event_desc "to (?<dst_ip_address>\d+\.\d+\.\d+\.\d+)/(?<dst_port>\d+)" | stats count by dst_ip_address, dst_port

If this doesn't work, if you could post an actual event I might be able to fine tune it for you.

Hope this helps 🙂

View solution in original post

0 Karma

Thanks. I removed field=event_desc, and I still get the matching events but no results found.

I have the Firewall app, but it doesn't give me all the info I need.

0 Karma

Builder

Ahhh... well in that case get rid of field=event_desc and you should be good.

Also, seeing as you're dealing with ASA logs, you might find the "Splunk for Cisco Firewalls" and "Cisco Security Suite" apps worth a look.

Thank you for you help. Unfortunately, the results come out empty. Splunk says it finds 1900+ matches though. Here is an actual event.

Sep 23 18:14:15 10.10.10.1 Sep 23 2013 18:16:15: %ASA-6-106015: Deny TCP (no connection) from 15.16.17.8/80 to 12.22.12.1/1398 flags FIN PSH ACK on interface outside

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!