Splunk Search

Need Help Restricting Results

Path Finder

I am trying to provide our data center customers a view of their firewall permits and denies (based on cisco fwsm logs). The requirements I have been given are to restrict what a customer can search for to either events for their source or destination and by period of time the own the IP. Also, this cannot be a separate app. I need to figure out a way to restrict certain events to certain users based on the source and destination IP and time.

I have a lookup file that specifies a subnet for CIDR matching and has columns for mapping ownership to a customer by IP. The lookup also has a column to reference a date code for both the source and destination IP so I can exclude results by event time.

I have a search that fulfills the requirements, however, I can't figure out a way to restrict results by role. It is a pipeline search, so I can't create an eventtype. My understanding of summary indicies preclude their use. My thinking is the only way to do it is to create an app, but the requirements specify no.

Here is an example of one of the searches:

owner_src="FAC" OR owner_dst="FAC" type="Built" OR type="Deny" 
| convert timeformat="%m%d%y" ctime(_time) as c_time 
| eval owner_valid_src = if(c_time >= date_filter_src, "Yes", "No") 
| eval owner_valid_dst = if(c_time >= date_filter_dst, "Yes", "No") 
| search owner_valid_src="yes" OR owner_valid_dst="yes"
Tags (1)

Splunk Employee
Splunk Employee

I think you want to convert your lookup to be an automatic time based lookup, and then use the search filter in the role for each customer on the owner_src and owner_dst fields. That way you do not need the convert, evals and 2nd search.

0 Karma

Path Finder

Currently four, but there are likely to be more as we add new customers.

0 Karma


How many roles will this scale to ?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>