How to find events that match except with the fields reversed.

[zaludma]

I am trying to figure out how to display all of the reverse matches in a list by each event. This would include showing the original event and all events that match with that event except for having the fields reversed. For example:

Foo Bar

Would be displayed along with all reverse matches represented by:

Bar Foo

 So if there were a thousand or so values, it would go down the list and find all reverse matches.

Foo Bar    |    Bar Foo
           |    Bar Foo
           |    Bar Foo
-----------------------------
Hello There|    There Hello
           |    There Hello
-----------------------------
Src Dst    |    Dst Src
           |    Dst Src
           |    Dst Src
           |    Dst Src

I am not sure where to go from here (https://wiki.splunk.com/Deploy:Combine_bi-directional_network_logs).

Using the example from this page, if I wanted to find bidirectional communications using these logs:

2007-09-14 10:54:58.130 0.896 TCP 216.129.82.250:2691 -> 209.104.58.141:80 3 144 1

2007-09-14 10:54:55.378 5.184 TCP 209.191.118.103:25 -> 209.104.37.200:26490 26 1453 1

I would want to search based on Source IP/Port and Destination IP/Port. I would be looking for matches based on those flipped values like:

<date> <time> <duration> <protocol> 209.104.58.141:80 -> 216.129.82.250:2691 <etc.>

<date> <time> <duration> <protocol> 209.104.37.200:26490 -> 209.191.118.103:25 <etc.> 

Field names would be "src_ip", "src_port", "dst_ip", and "dst_port".

[saravanan90]

This may help...

base search  |stats count by src_ip src_port dst_ip dst_port
| eval src=(replace(src_ip,"\.","").src_port) | eval dst=(replace(dst_ip,"\.","").dst_port) | table src_ip, src, src_port,dst,dst_ip,dst_port
| eval commonid=if(src>dst, src.src_port.dst.dst_port, dst.dst_port.src.src_port)
| eventstats count by commonid
| where count > 1

[scelikok]

Hi @zaludma,

Can you please show your query and its output that you want to find reverse matches? Are we talking specific fields/values?  

[zaludma]

@scelikok I will use the data from the link as an example. I am trying to find bidirectional netflow based on IPs and Ports. I will add examples to the post.