Splunk Search

How to troubleshoot connectivity issues using Splunk?

trentsnowbarger
New Member

a customer reports intermittent connectivity issues to the internet, a website, what have you. Our instance of Splunk captures logs from our firewalls and other network devices. 
What are some search strings I would use, or how would I start using Splunk to troubleshoot historical (not live) connection issues going out to a website?

I know this is a broad question, but I'm just looking for some ideas on where to start. Thank you.

Labels (1)
0 Karma

smurf
Communicator

Hi,

first, I would look if a firewall dropped anything. So search the index with firewall logs for the user's IP address and the website's IP address, most likely port 80 or 443 since it is a website. I would do the same for any other network device like IPS/IDS. 

Hope this helps, at least a little.

smurf

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...