Splunk Search

Splunk Query to find changes in ip address and url

asahni
Loves-to-Learn

Hi Guys,

I am trying find changes in office 365 ip address and URL using SPL by comparing results from today to yesterday.
Probably there is an efficient way of doing this too!
 

Script:
index=dp source="rest://Query" earliest=-1d@d latest=now

| stats values(tcpPorts) as tcpPorts_t values(udpPorts) as udpPorts_t values(ips{}) as ips_t by urls{}

|  appendcols

    [search index=dp source="rest://Query" earliest=-2d@d latest=-1d@d

| stats values(tcpPorts) as tcpPorts_y values(udpPorts) as udpPorts_y values(ips{}) as ips_y by  urls{} ]

| eval change=if("tcpPorts_t"="tcpPorts_y" OR "udpPorts_t"="udpPorts_y" or "ips_t"="ips_y", "Change", "No Change")

| join type=left  change

    [search index=dp source="rest://Query" earliest=-1d@d latest=now

| stats values(tcpPorts) as tcpPorts_t values(udpPorts) as udpPorts_t values(urls{}) as urls{}_t by ips{}

|  appendcols

    [search index=dp source="rest://Query" earliest=-2d@d latest=-1d@d

| stats values(tcpPorts) as tcpPorts_y values(udpPorts) as udpPorts_y values(urls{}) as urls{}_y by ips{} ]

| eval change=if("tcpPorts_t"="tcpPorts_y" OR "udpPorts_t"="udpPorts_y" or "urls{}_t"="urls{}_y", "Change", "No Change") ]

| table  change tcpPorts_t tcpPorts_y udpPorts_t udpPorts_y ips_t ips_y urls{}_t urls{}_y

|  sort - change

 
Ip address are appearing ok but getting just 1 value for url. Not too sure if Makemv will help here?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...