Splunk Search

If "this AND this" OR "this AND this" then ...

Path Finder

I am looking for a string that will show results for the following:
if (srcIP="x" AND srcPORT="y") OR (destIP="x" AND destPORT="y") then ... [show results] ...

Tags (3)
0 Karma
1 Solution

Influencer

You pretty much have answer with in your question. The only pre-requisite is to have those fields extracted already.

index=your_index sourcetype=your_sourcetype (srcIP="x" AND srcPORT="y") OR (destIP="x" AND destPORT="y") 

View solution in original post

Path Finder

So... the answer below works for this question but, like many things, doesn't work in all cases.

I was trying to do an eval and stats statement but formatting it as so is not pulling the data.
Thus, some searches still need a special way of claiming an if, and string.

When I find it, I will update.

ex.

sourcetype="A" OR sourcetype="B" 
| eval HOST=case(sourcetype="A",host,sourcetype="B",hst2)
| where (method="GET" AND method="HEAD" AND method="OPTIONS" AND method="POST" AND method="PUT" AND method="TRACE" AND method="TRACK") <--this part messes up the results.  I tried an if statement as well.
| stats count(path) as PATH by HOST
| where PATH>=10
0 Karma

SplunkTrust
SplunkTrust

Just a little improvement on the search:

ex. sourcetype="A" OR sourcetype="B" 
(method="GET" AND method="HEAD" AND method="OPTIONS" AND method="POST" AND method="PUT" AND method="TRACE" AND method="TRACK") 
| eval HOST=case(sourcetype="A",host,sourcetype="B",hst2)
| stats count(path) as PATH by HOST
| where PATH>=10

Since you're not using the HOST in any of the if and or's, move it to the base search and use the eval on the reduced set of results.

hope this makes sense ...

cheers, MuS

0 Karma

Path Finder

Thanks for the reply. Sadly, I tried that as well. This format pulled no results rather quickly where I should be seeing exactly one.

"method" is the same in both sourcetypes. <--so that isn't the issue.
If I put "method" (or any other field) in an if/case/etc... statement it doesn't pull any results. <--but if I remove the multiple ANDs and only have one "method", results show up.

0 Karma

Legend

Have you tried where. Try this

base search | where (srcIP="x" AND srcPORT="y") OR (destIP="x" AND destPORT="y") 
0 Karma

Influencer

You pretty much have answer with in your question. The only pre-requisite is to have those fields extracted already.

index=your_index sourcetype=your_sourcetype (srcIP="x" AND srcPORT="y") OR (destIP="x" AND destPORT="y") 

View solution in original post

Path Finder

Oh man. Thank you. I was way over thinking it. Quick response too.

0 Karma