Splunk Search

How to create a new internal IP field, at search time, from src and dest IP fields?

Communicator

I'd like to create a field at search time, we'll call it internalip. I can already filter by CIDR block and get the results I want, but I need more depth than that for a lookup I'd like to do. The problem is with my IDS logs, depending on the directional flow, the internal IP can be either srcip or destip (this particular search will never return both internal IP addresses). I'd like a query to search both srcip and dest_ip fields for a specific private network IP block, and assign that value to my new field. How do I accomplish this?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

What you need is a calculated field which will take the first non-null value from srcip and destip field and assign to internal_ip field. More info here. http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/definecalcfields

props.conf

[yoursourcetype]
EVAL-internal_ip = coalesce(src_ip,dest_ip)

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

What you need is a calculated field which will take the first non-null value from srcip and destip field and assign to internal_ip field. More info here. http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/definecalcfields

props.conf

[yoursourcetype]
EVAL-internal_ip = coalesce(src_ip,dest_ip)

View solution in original post

0 Karma

Communicator

Thanks for the quick response, but coalesce takes the first non-null value, which means data will be missing. I imagine it will be a more complicated query.

0 Karma

SplunkTrust
SplunkTrust

In an event, you'll have either srcip OR destip right? So it'll take whatever is available. Easiest option is the run following query and check.

your base search for yoursourcetype | table src_ip dest_ip | eval internal_ip = coalesce(src_ip,dest_ip)
0 Karma

Communicator

I need to clarify, there will always be one src and one dest IP. What I meant to say is, there will never be an internal IP for BOTH src and dest IPs. Basically one IP will always be internal, and the other will always be external. Sorry for the confusion.

0 Karma

SplunkTrust
SplunkTrust

So if you've a way to identify the internal ip, may using the subnet, then you can use a cidrmatch("X",Y) function in eval to check which one is the internal ip and use that. Like this (using sample ip subnet)

props.conf

[yoursourcetype]
EVAL-internal_ip= if(cidrmatch("123.132.32.0/25",src_ip),src_ip,dest_ip)
0 Karma

Communicator

That works! Thank you.

0 Karma

Communicator

So, I think I'm over thinking this. Here is one way to get this to work. There is some inherent inefficiency with this, but it works (ideally I would only merge blocks of IPs which match my criteria). I'll look into the cidrmatch function, that may help.

eval ipaddress=mvappend(src_ip,dest_ip)
0 Karma