Splunk Search

How to use EVAL Concatenation within TSTATS?

donaldwayne1975
Path Finder

Want to improve the TSTAT for the "Substantial Increase In Port Activity" correlation search.

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest_port 
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme

Was able to add the "action" field to determine if it was allowed or blocked with the below.

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by All_Traffic.dest_port All_Traffic.action 
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme

I want to be able to use the EVAL to concatenate several fields and use the TIMECHART to determine the previous x days volume of the same traffic. I have tried the below, but it does not show results. Thoughts or suggestions for using the EVAL to concatenate within a TSTAT? Thank you in advance for your time.

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by All_Traffic.dest_port All_Traffic.action All_Traffic.dest_ip All_Traffic.src_ip
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme
| eval session= All_Traffic.src_ip."->".All_Traffic.dest_ip."/".All_Traffic.dest_port." was ".All_Traffic.action
| timechart span=1d limit=0 count by session
0 Karma
1 Solution

donaldwayne1975
Path Finder

Welp! results show up when you include _time. answering your own question... facepalm.gif

| tstats allow_old_summaries=true count,values(All_Traffic.dest_port) AS dest_port values(All_Traffic.action) AS action values(All_Traffic.dest_ip) AS dest_ip values(All_Traffic.src_ip) AS src_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by _time,All_Traffic.dest_port, All_Traffic.action, All_Traffic.dest_ip, All_Traffic.src_ip
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme
| eval sessions = src_ip."->".dest_ip."/".dest_port." was ".action
| timechart span=1d limit=0 count by sessions

View solution in original post

0 Karma

donaldwayne1975
Path Finder

Welp! results show up when you include _time. answering your own question... facepalm.gif

| tstats allow_old_summaries=true count,values(All_Traffic.dest_port) AS dest_port values(All_Traffic.action) AS action values(All_Traffic.dest_ip) AS dest_ip values(All_Traffic.src_ip) AS src_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by _time,All_Traffic.dest_port, All_Traffic.action, All_Traffic.dest_ip, All_Traffic.src_ip
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme
| eval sessions = src_ip."->".dest_ip."/".dest_port." was ".action
| timechart span=1d limit=0 count by sessions
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...