Splunk Search

Search help

Path Finder

Hi All,The following search has been created to identify the unsecure communications.Also i need to see the end-to-end connectivity if it’s successful on unsecure protocol. For example, some services are configured in F5 with HTTP redirection profile. Now ultimately you will observe port 80 traffic on Edge firewall but F5 then redirects it to HTTPS.so please could you help us to achive these?

(index=paloalto OR index=juniper) (dest_port= 20 OR
dest_port= 22 OR
dest_port= 23 OR
dest_port= 53 OR
dest_port= 139 OR
dest_port= 80 OR
dest_port= 445 OR
dest_port= 3389 OR
dest_port= 21) | lookup Port_service.csv dest_port as dest_port OUTPUT service | stats count values(src_ip) by dest_port service dest_ip transport action  | table values(src_ip) dest_port service transport dest_ip count action

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...