Splunk Search

How to count equal sources

saschar
New Member

Hello,
I want to count the denials from the same source ip. How can I do this?
The Log looks like this:

May 28 07:22:30 aaa.aaa.aaa.aaa %ASA-4-106023: Deny icmp src MAN-TRANS-PIX:bbb.bbb.bbb.bbb dst MAN-PRIV-INFRA-DMZ1:dns1.man.internal (type 8, code 0) by access-group "MAN-TRANS-PIX_access_in" [0xe068225a, 0x0]

Thanks for help.

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you're looking for a specific source ip you can do this:

search for that source ip and denial events | stats count

If you're looking for a general count by source ip you can do this:

search for denial events | stats count by src_ip

Alternatively, this:

search for denial events | top src_ip

Other than that you may need to clarify your goal.

View solution in original post

saschar
New Member

Now I've tried the search on another server with the same asa-logs. On this my search and counting works fine but on the production-server I get no results...

0 Karma

saschar
New Member

I am looking for a general count to get the sources which produces the most noise.
The count by src_ip producing no results. I think it's because the "MAN-TRANS-PIX:" in front of the IP. How can can I get these IP's out of this?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you're looking for a specific source ip you can do this:

search for that source ip and denial events | stats count

If you're looking for a general count by source ip you can do this:

search for denial events | stats count by src_ip

Alternatively, this:

search for denial events | top src_ip

Other than that you may need to clarify your goal.

BobM
Builder

If you do not have that extraction, you are probably missing other usefull information. I suggest you install the free "Technology Add on for Cisco ASA" to all your indexers and search heads.

http://splunk-base.splunk.com/apps/58196/technology-add-on-for-cisco-asa

saschar
New Member

Thanks.
That was the problem.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you don't yet have the source ip extracted into a field you can do something like this to get you started quickly:

... | rex "MAN-TRANS-PIX:(?<src_ip>(\d{1,3}\.){3}\d{1,3})" | ...
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...