Splunk Search

How to find ip addresses which have both received and sent a message?

masoud
Explorer

It is sort of like multiplying the set with itself and getting a subset in mathematical term.

 

my data is sth like this

src_ip    dst_ip time X Y

1.1.1.1   2.2.2.2 1pm .. ...

2.2.2.2   3.3.3.3  3pm .. ...

Labels (5)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

VatsalJagani and PickleRick's answers all should work.  Here's an alternative:

 

| stats values(src_ip) as src_ip values(dst_ip) as dst_ip
| eval src_ip_in_dst_ip = mvmap(src_ip, if(isnull(mvfind(dst_ip, "^" . src_ip . "$")), null(), src_ip))

 

Output using your sample data is

src_ip
dst_ip
src_ip_in_dst_ip
1.1.1.1
2.2.2.2
2.2.2.2
3.3.3.3
2.2.2.2

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

If I understand you correctly, you have in your events a source and destination fields and you want to find values which are present in both of those fields within your time range (which would mean that there was a connection to such an IP as well as from it).

There are probably many different approaches to such problem but I'd simply do

<your search>
| stats values(src_ip) as src_ip values(dst_ip) as dst_ip
| transpose
| rename "row 1" as IP
| mvexpand IP
| stats count by IP
| where count=2

VatsalJagani
SplunkTrust
SplunkTrust

@masoud - This would be the simplest mathematical way to do it. (In Splunk though there could be a better way of doing depending on the data.)

| set intersect [<your-search> | dedup src_ip | table src_ip] [<your-search> | dedup dest_ip | table dest_ip]

 

I hope this helps!!! Karma would be appreciated!!!

masoud
Explorer

Thx mate. I update the question with more information about my data. could you please have a look?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

To get help in search forum, you really want to illustrate your data, or at least let people know which application/log your are referring to and pray that somebody here has worked on that same application/log.

0 Karma

masoud
Explorer

Thx mate. I update the question with more information about my data. could you please have a look?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

VatsalJagani and PickleRick's answers all should work.  Here's an alternative:

 

| stats values(src_ip) as src_ip values(dst_ip) as dst_ip
| eval src_ip_in_dst_ip = mvmap(src_ip, if(isnull(mvfind(dst_ip, "^" . src_ip . "$")), null(), src_ip))

 

Output using your sample data is

src_ip
dst_ip
src_ip_in_dst_ip
1.1.1.1
2.2.2.2
2.2.2.2
3.3.3.3
2.2.2.2

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...