Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Is it possible to put a conditional statement in a...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have files I am ingesting that have variable formats. I want to pick those lines out that only have an IP address as the third value and extract that as srcIP. Is this possible to essentially put a conditional statement in so I don't get all the garbage from the "other" data in the logs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if the IP you are looking for is before %ASA then try this which will save that in srcIP field:
yourBasequery
| rex "(?<srcIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s%ASA"
| user srcIP here
check the extraction here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if the IP you are looking for is before %ASA then try this which will save that in srcIP field:
yourBasequery
| rex "(?<srcIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s%ASA"
| user srcIP here
check the extraction here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I was able to solve this by using field extractor in the webui. It gave me the ability to say a string is "required" which would filter for %ASA. I was then able to utilize it to build my regular expression and it worked very nicely
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We may see this:
Oct 31 13:48:30 10.251.44.137 %ASA-4-106023: Deny tcp src clc:10.40.2.13/59318 dst outside:46.6.11.38/3389 by access-group "clc_in" [0x0, 0x0]
Or
Oct 31 13:48:30 10.251.44.137 %ASA-4-733100: [ Scanning] drop rate-1 exceeded. Current burst rate is 2 per second, max configured rate is 10; Current average rate is 8 per second, max configured rate is 5; Cumulative total count is 5176
I guess one could say I want only the lines that have %ASA in them. How do I do that?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't understand. both of these events have %ASA in them. Also, is your intention to drop the events you don't want completely (not indexed) or keep the events but not extract the src_ip field?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Which ip address value you want to pick? could you highlight?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It should be possible. Can you post some example events?
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
