Splunk Search

Search that Alerts for two events with a matching field

jinito14002
New Member

Hi I'm new to Splunk and am having a hard time finding a simple solution to this.
I tried using subsearch and append but couldn't do it. Wherever I look, it only has complicated solutions with at least 5 pipes.
How do I create an alert if two certain events occurred and their ip addresses match? (Source OR Destination ip whichever)
1. index=snort sid=100 src_ip=192.168.1.3 dst_ip=192.168.1.5
2. index=snort sid=101 src_ip=192.168.1.5 dst_ip=192.168.1.3

If its possible to check whether if event #2 occurred within 5 minutes of event #1 at the same time, that would be great.

0 Karma
1 Solution

aohls
Contributor

I am not sure what extracts you have setup but you could use a transaction: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Transaction

| transaction src_ip maxspan=5m

Need some more information to get things exact but it seems using transaction should work. If you can provide some more information that would help.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI jinito14002,
try something like this:

index=snort
| eval ip=src_ip.",".dst_ip
| makemv ip delim=","
| mvexpand ip
| stats count BY ip
| where count>1

Bye.
Giuseppe

0 Karma

aohls
Contributor

I am not sure what extracts you have setup but you could use a transaction: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Transaction

| transaction src_ip maxspan=5m

Need some more information to get things exact but it seems using transaction should work. If you can provide some more information that would help.

0 Karma

jinito14002
New Member

Thanks, this did the trick for me. just needed that one word "transaction"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...