Splunk Search

Splunk - Alerting if ip address/ url changed over last 24 hours

asahni
Loves-to-Learn

Hi Guys,

I am trying find changes in office 365 ip address and URL using SPL by comparing results from today to yesterday.
Probably there is an efficient way of doing this too!
 

Script:
index=dp source="rest://Query" earliest=-1d@d latest=now

| stats values(tcpPorts) as tcpPorts_t values(udpPorts) as udpPorts_t values(ips{}) as ips_t by urls{}

|  appendcols

    [search index=dp source="rest://Query" earliest=-2d@d latest=-1d@d

| stats values(tcpPorts) as tcpPorts_y values(udpPorts) as udpPorts_y values(ips{}) as ips_y by  urls{} ]

| eval change=if("tcpPorts_t"="tcpPorts_y" OR "udpPorts_t"="udpPorts_y" or "ips_t"="ips_y", "Change", "No Change")

| join type=left  change

    [search index=dp source="rest://Query" earliest=-1d@d latest=now

| stats values(tcpPorts) as tcpPorts_t values(udpPorts) as udpPorts_t values(urls{}) as urls{}_t by ips{}

|  appendcols

    [search index=dp source="rest://Query" earliest=-2d@d latest=-1d@d

| stats values(tcpPorts) as tcpPorts_y values(udpPorts) as udpPorts_y values(urls{}) as urls{}_y by ips{} ]

| eval change=if("tcpPorts_t"="tcpPorts_y" OR "udpPorts_t"="udpPorts_y" or "urls{}_t"="urls{}_y", "Change", "No Change") ]

| table  change tcpPorts_t tcpPorts_y udpPorts_t udpPorts_y ips_t ips_y urls{}_t urls{}_y

|  sort - change

 
Ip address are appearing ok but getting just 1 value for url. Not too sure if Makemv will help here?

 
Labels 
Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...