Splunk Search

How do i group the log for ip, or type?

graidelak
New Member

Hi I want to know how can i group my log from my firewall by source ip, or dest_ip or type, because i want to make a report that show me the attack or events by groups.

Maybe is a stupid question but im just newbie using splunk and i want to learn how can i do that.

Thank you

Tags (1)
0 Karma

rogerdpack
Path Finder

query | chart by host

by important part being "by host"

0 Karma

graidelak
New Member

Im sorry if you couldn't understand me

I mean I want to do a report that tell me who attack me and which ip, things like that, but I have no idea how to group these events.

0 Karma

Ayn
Legend

You'd need to create fields out of your logs (covered in the tutorial, tl;dr: use the interactive field extractor in splunkweb), and then grab stats on the fields you mention (also covered in the tutorial). If you want to create a search form that only requires you to input an IP number and automatically get charts, tables etc, have a look at the "Build forms" section of the developer manual).

graidelak
New Member

Yeah I did but I can't group those events. Let me see if I can explain better.

I want to see my firewall log (watchguard) and make some search by src_ip or dest_ip and then a report to see how many deny, attack, or error i had.

I saw many apps for firewall but i didn't see one for watchguard firebox

0 Karma

Ayn
Legend

Did you take the Splunk tutorial? It's a great way to get past the "I'm very new to Splunk" phase.

0 Karma

melting
Splunk Employee
Splunk Employee

I am not sure I understand the question

If you want statistics then take a look here:

If you want these combined together, perhaps the transaction search cmd

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...