Splunk Search

How to use EVAL Concatenation within TSTATS?

donaldwayne1975
Path Finder

Want to improve the TSTAT for the "Substantial Increase In Port Activity" correlation search.

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest_port 
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme

Was able to add the "action" field to determine if it was allowed or blocked with the below.

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by All_Traffic.dest_port All_Traffic.action 
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme

I want to be able to use the EVAL to concatenate several fields and use the TIMECHART to determine the previous x days volume of the same traffic. I have tried the below, but it does not show results. Thoughts or suggestions for using the EVAL to concatenate within a TSTAT? Thank you in advance for your time.

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by All_Traffic.dest_port All_Traffic.action All_Traffic.dest_ip All_Traffic.src_ip
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme
| eval session= All_Traffic.src_ip."->".All_Traffic.dest_ip."/".All_Traffic.dest_port." was ".All_Traffic.action
| timechart span=1d limit=0 count by session
0 Karma
1 Solution

donaldwayne1975
Path Finder

Welp! results show up when you include _time. answering your own question... facepalm.gif

| tstats allow_old_summaries=true count,values(All_Traffic.dest_port) AS dest_port values(All_Traffic.action) AS action values(All_Traffic.dest_ip) AS dest_ip values(All_Traffic.src_ip) AS src_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by _time,All_Traffic.dest_port, All_Traffic.action, All_Traffic.dest_ip, All_Traffic.src_ip
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme
| eval sessions = src_ip."->".dest_ip."/".dest_port." was ".action
| timechart span=1d limit=0 count by sessions

View solution in original post

0 Karma

donaldwayne1975
Path Finder

Welp! results show up when you include _time. answering your own question... facepalm.gif

| tstats allow_old_summaries=true count,values(All_Traffic.dest_port) AS dest_port values(All_Traffic.action) AS action values(All_Traffic.dest_ip) AS dest_ip values(All_Traffic.src_ip) AS src_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by _time,All_Traffic.dest_port, All_Traffic.action, All_Traffic.dest_ip, All_Traffic.src_ip
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme
| eval sessions = src_ip."->".dest_ip."/".dest_port." was ".action
| timechart span=1d limit=0 count by sessions
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...