Splunk Search

Search Same URLs between two endpoints, each endpoint different time range

pkohn117
Explorer

I'm trying to find what URLs are the same that two endpoints went to, but at different times.

Example: What URLs did endpoint 1 go to between 7 and 7:15AM Monday morning, what URLs did endpoint 2 go to on Tuesday afternoon between 4 and 4:15PM, and list the URLs that are the same. I also have an exclusion for some common URLs like google.com. The point of this is when malicious traffic is detected from two endpoints going to the same destinations, check to see what other URLs they went to that were the same.

Here is what I have but it doesn't limit the time so there are a ton of extra URLs that shouldn't be showing:

index=web sourcetype=proxya filter_result=success c_ip=X.X.X.X OR c_ip=y.y.y.y NOT cs_host IN ( google.com, bing.com, etc.org ) | dedup cs_host, c_ip | eventstats count by cs_host | where count = 2 | table _time c_ip cs_host | sort -_time

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...