Splunk Search

Sniffing Ports Up/Down -- IFconfig?

ddecker03
Loves-to-Learn Everything

Looking for a way to monitor sniffing ports on a sensor.  Each port is tied to a different part of the system and would like a dashboard notification UP/DOWN if traffic has not been rcvd say in 1-5 minutes.  

i thought about doing IFCONFIG, but I think I made it to complicated by using grep to narrow down just the RX/TX information.   

ifconfig | egrep -e ^eth | grep -v "inet\|UP"  which does a pretty good job for CLI output.   

I tried installing the App *Nix but cant really get it to work.  

I am using a Splunk server, and the "sensors" are a dffierant server which has the UFW.  

 

Thanks

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Consider putting your CLI command into a shell script and invoking the shell script as a Splunk scripted input every 5 minutes.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...