Splunk Search

Optimize my search

Mai_splunk
Explorer
 
Hi team!
 
How can I optimize the following search?
I want to find ips that have made an attack and have been blocked by the UTM but that have registered any allowed connection.
 
index=xxxx type=utm action=blocked | table srcip | join type=inner [search index=xxxx type=traffic action=allowed] | stats count by srcip
 
Thanks in advance!
Labels (1)
1 Solution

Richfez
SplunkTrust
SplunkTrust

I'd use CIDR notation and see if it gets you farther:

srcip=10.0.0.0/8 OR srcip=172.16.0.0/16

If you want ONLY public IPs, it'd be something like

srcip!=10.0.0.0/8 AND srcip!=172.16.0.0/12 AND srcip!=192.168.0.0/16 

That should work.  I don't believe wildcards and quotes trigger the real CIDR ... "stuff" in Splunk to search on, but the above should do it.

 

View solution in original post

Richfez
SplunkTrust
SplunkTrust

It could be as simple as this:

index=fw ((type=utm action=blocked) OR (type=traffic action=allowed)) | stats count by srcip

But probably you'll want something a bit more like

index=fw ((type=utm action=blocked) OR (type=traffic action=allowed)) 
| stats dc(action) as has_both by srcip 
| search has_both>1 

There's actually more possible optimization (especially if srcip is an index time field), but that's going to cut nine hundred percent off your search, I would think, and nine million percent off the search if it's actually *big*.

Mai_splunk
Explorer

Thanks so much, it's exactly that i want!

One more doubt, now, How I can reduce the serarch only a public IP? I'm trying this:

srcip!="10.*" AND srcip<"172.16.*" AND srcip>"172.31.*" AND srcip!="192.168.*"

but in the 3th parameter i get any results.

 

Richfez
SplunkTrust
SplunkTrust

I'd use CIDR notation and see if it gets you farther:

srcip=10.0.0.0/8 OR srcip=172.16.0.0/16

If you want ONLY public IPs, it'd be something like

srcip!=10.0.0.0/8 AND srcip!=172.16.0.0/12 AND srcip!=192.168.0.0/16 

That should work.  I don't believe wildcards and quotes trigger the real CIDR ... "stuff" in Splunk to search on, but the above should do it.

 

View solution in original post

Mai_splunk
Explorer

Thanks so much @Richfez  you have been a great help.

Take care.

0 Karma

to4kawa
SplunkTrust
SplunkTrust

index=xxxx ( type=utm action=blocked ) OR ( type=traffic action=allowed )| stats count dc(action) as flag by srcip | where flag=2

0 Karma