Problem with Cisco ASA search query (iplocation)

[madstylex]

Hi,

I have a search string that shows the top 20 security related events by country on my Cisco ASA.

eventtype=cisco-security-events | iplocation src_ip | stats count by Country | sort 20 - count

It works well and displays the countries and total number of events for whichever time range I've specified.

However, when I want to click an individual country (Australia) and view the events, Splunk returns "No Results Found". Even though there are 8000+ events for Australia

A manual search also shows no results found:

eventtype=cisco-security-events  Country=Australia | iplocation src_ip

Can someone please explain why this is happening and kindly offer a solution?

Thanks Ninjas!

[maciep]

The problem is likely that the Country field doesn't exist until the iplocation command creates it. So for your manual, search, does something like this work?

eventtype=cisco-security-events | iplocation src_ip | where Country="Australia"

[madstylex]

That manual search does indeed work. Any idea on how to view the events by clicking through the results of my top 20 search?

[maciep]

Splunk tries to figure out how to drill down on its own, but doesn't always do a good job. If this is in a dashboard, Splunk allows you to configure how that works. I included some links below.

But I wonder if you change your base search to something like this, whether Splunk will add the country condition to a later spot in the search when drilling down for you?

 eventtype=cisco-security-events | iplocation src_ip | search Country=* | stats count by Country | sort 20 - count

http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/Understandbasictableandchartdrilldownactions

http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms

[ndoshi]

I just tested your idea of eventtype=cisco-security-events | iplocation src_ip | search Country=* | stats count by Country | sort 20 - count and that seems to work for a drilldown with iplocation without having to do anything more.