Splunk Search

How to count equal sources

saschar
New Member

Hello,
I want to count the denials from the same source ip. How can I do this?
The Log looks like this:

May 28 07:22:30 aaa.aaa.aaa.aaa %ASA-4-106023: Deny icmp src MAN-TRANS-PIX:bbb.bbb.bbb.bbb dst MAN-PRIV-INFRA-DMZ1:dns1.man.internal (type 8, code 0) by access-group "MAN-TRANS-PIX_access_in" [0xe068225a, 0x0]

Thanks for help.

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you're looking for a specific source ip you can do this:

search for that source ip and denial events | stats count

If you're looking for a general count by source ip you can do this:

search for denial events | stats count by src_ip

Alternatively, this:

search for denial events | top src_ip

Other than that you may need to clarify your goal.

View solution in original post

saschar
New Member

Now I've tried the search on another server with the same asa-logs. On this my search and counting works fine but on the production-server I get no results...

0 Karma

saschar
New Member

I am looking for a general count to get the sources which produces the most noise.
The count by src_ip producing no results. I think it's because the "MAN-TRANS-PIX:" in front of the IP. How can can I get these IP's out of this?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you're looking for a specific source ip you can do this:

search for that source ip and denial events | stats count

If you're looking for a general count by source ip you can do this:

search for denial events | stats count by src_ip

Alternatively, this:

search for denial events | top src_ip

Other than that you may need to clarify your goal.

BobM
Builder

If you do not have that extraction, you are probably missing other usefull information. I suggest you install the free "Technology Add on for Cisco ASA" to all your indexers and search heads.

http://splunk-base.splunk.com/apps/58196/technology-add-on-for-cisco-asa

saschar
New Member

Thanks.
That was the problem.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you don't yet have the source ip extracted into a field you can do something like this to get you started quickly:

... | rex "MAN-TRANS-PIX:(?<src_ip>(\d{1,3}\.){3}\d{1,3})" | ...
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...