Searching Splunk

[anamolous86]

So, I have just been introduced to this tool through my work. I had a question about how to link some search criteria. What I would like my search to do is search first by an IP address that I input, then link that IP address to a username, and finally give me a log of their activity within plus and minus two hours.
Thanks in advance!

[alanfinlay]

Mapping userid to ip address is required so you need to determine how to get that data. You could perhaps monitor DHCP server logs. You could use lookup table - see Manager -> Lookups and have the mapping defined in a file, or you could have the mapping stored in a Database and use the DBConnect app.

Once you have that mapping you can build a search on the activity data based on userid from an input of ip address. I am not sure what you mean by plus or minus 2 hours. Do you input a time as well? Why not just specify a time range in the search?

[ChrisG · Accepted solution]

There are good resources for learning, if you haven't looked at them, you should!

• Splunk Tutorial
• Search Manual
• Search command cheat sheet and search language quick reference card
• Exploring Splunk: Search Processing Language (SPL) Primer and Cookbook

[anamolous86]

Ah, great! The manual is going to be most helpful for me. Thank you!