Splunk Search

Looking for new events

richnavis
Contributor

Good Day Everyone,

I"m trying to construct a search that will search our weblogs over a one hour period and report on IP addresses that didn't appear in the first half hour. I would like to display the sum of new IPs in a timechart. The approach I'm started to take is to search the hour, create 1 minute buckets, group by IP address, and add a column that indicates if it was first half or second half of the hour so the data now looks something like this..
Time IP &nbsp Count Group
08:00 10.10.10.10 20 First
08:01 10.10.10.10 27 First
08:00 10.10.10.11 3 First
.....
08:32 10.10.10.11 79 Second
08:33 10.10.10.14 11 Second
08:34 10.10.10.14 44 Second
...

So, now I'm trying to Create a TimeChart that includes ALL values from first group, and ONLY IPs in the second group that aren't included in the first group. This is where I'm stumped.

0 Karma

woodcock
Esteemed Legend

Like this:

... | eval date_minute = strftime(_time, "%M") | eval FirstOrSecond=if((date_minute>=30), "Second", "First") | eventstats dc(FirstOrSecond) AS numHalves BY IP | where FirstOrSecond="First" OR (FirstOrSecond="Second" AND numHalves=1) | timechart ...
0 Karma

jensonthottian
Contributor

index=abc earliest=-60m latest=-31m |table _time IP |eval Group=First | join _time [search index= abc NOT [search index=abc earliest=-60m latest=-31m |dedup IP| table IP] earliest=-30m latest=now |table _time IP|eval Group=Second]| table _time Group

This should give you result from group 2 avoiding IP's from first group.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...