Splunk Search

Sniffing Ports Up/Down -- IFconfig?

ddecker03
Loves-to-Learn Everything

Looking for a way to monitor sniffing ports on a sensor.  Each port is tied to a different part of the system and would like a dashboard notification UP/DOWN if traffic has not been rcvd say in 1-5 minutes.  

i thought about doing IFCONFIG, but I think I made it to complicated by using grep to narrow down just the RX/TX information.   

ifconfig | egrep -e ^eth | grep -v "inet\|UP"  which does a pretty good job for CLI output.   

I tried installing the App *Nix but cant really get it to work.  

I am using a Splunk server, and the "sensors" are a dffierant server which has the UFW.  

 

Thanks

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Consider putting your CLI command into a shell script and invoking the shell script as a Splunk scripted input every 5 minutes.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...