Splunk Search

How to search the count of keywords for each individual event, not for all events?

adaam94
Explorer

How do I count the number of times keywords such as DROP, SELECT, FROM and WHERE appear for each event I have indexed? Looking at the HTTP header example I have, this is a single event. Is there an easy way to only count keywords from this as the searches I have used count all the keywords for all the events, but I only want a keyword count for each event.

"24455","POST","http://localhost:8080/tienda1/publico/pagar.jsp","HTTP/1.1","Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.8 (like Gecko)","no-cache","no-cache","text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5","x-gzip, x-deflate, gzip, deflate","utf-8, utf-8;q=0.5, *;q=0.5","en","localhost:8080","close","103","application/x-www-form-urlencoded","JSESSIONID=12546061FC0154DC98FEC5A70E87F6B4","B1='; DROP TABLE usuarios; SELECT * FROM datos WHERE nombre LIKE '%","anom"

So for this example the answer should be 4. any suggestions?

Thanks

0 Karma

adaam94
Explorer

index=* | regex payload="SELECT | UPDATE | INSERT | CREATE| ALTER | RENAME | WHERE | DROP"
| rex max_match=0 "(?SELECT | UPDATE | INSERT | CREATE |ALTER | RENAME | WHERE | DROP )"
| eval amount=mvcount(keywords)
| table payload, amount
| rename amount as "No. of Keywords"

0 Karma

Richfez
SplunkTrust
SplunkTrust

I ran it to test and made a few tweaks:

index=* | eval mystring="24455,POST,http://localhost:8080/tienda1/publico/pagar.jsp,HTTP/1.1,Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.8 (like Gecko),no-cache,no-cache,text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,/;q=0.5,x-gzip, x-deflate, gzip, deflate,utf-8, utf-8;q=0.5, ;q=0.5,en,localhost:8080,close,103,application/x-www-form-urlencoded,JSESSIONID=12546061FC0154DC98FEC5A70E87F6B4,B1='; DROP TABLE usuarios; SELECT FROM datos WHERE nombre LIKE '%,anom"
| rex max_match=0 field=mystring "(?<keywords>SELECT|UPDATE|INSERT|CREATE|ALTER|RENAME|WHERE|DROP)"
| eval amount=mvcount(keywords)
| table mystring, keywords, amount
| rename amount as "No. of Keywords"

And that returns keywords of DROP, SELECT and WHERE and a count of 3.

For your data, you won't likely need a lot of that:

sourcetype=blah eventtype=bleh my base search here ... 
| rex max_match=0 field=mystring "(?<keywords>SELECT|UPDATE|INSERT|CREATE|ALTER|RENAME|WHERE|DROP)"
| eval number_of_keywords=mvcount(keywords)

Give that a try and report back here to adaam94 on how it worked!

0 Karma

Richfez
SplunkTrust
SplunkTrust

adaam94,

I converted your comment to an answer so hopefully it can be accepted!

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...