Splunk Search

Table Formatting

tmarlette
Motivator

I am having some difficulty formatting a table the way I would like.
I am monitoring port state for a couple different ports on a few different machines.

Currently this is my search string:
sourcetype=port_scan (dst_port=443 OR dst_port=80 OR dst_port=4000 OR dst_port=43500 OR dst_port=43501) | dedup dest_ip | stats latest(dst_port_state) AS "state" by _time,dest_ip,dst_port,dest_host

This is what my output looks like:
alt text

I was wondering if anyone knew a way for it to look like this:

time, dest_ip, dest__host,"80 state", "4000 state"

12:00pm, 10.10.10.10,hostname, UP, DOWN

I'm thinking that I would need to make each port a field, and then report their status, but I don't know i'm missing an easier way?

Tags (2)
0 Karma

somesoni2
Revered Legend

Try this workaround

sourcetype=port_scan (dst_port=443 OR dst_port=80 OR dst_port=4000 OR dst_port=43500 OR dst_port=43501) | dedup dest_ip| eval allfields=strftime(_time,"%Y-%m-%d %H:%M:%S").",".dest_ip.",".dest_host | eval dst_port =dst_port." State"| chart latest(dst_port_state) AS "state" over allfields  by dst_port | rex field=allfields "(?<Time>.*),(?<dest_ip>.*),(?<dest_host>.*)" | fields - allfields
0 Karma

tmarlette
Motivator

This works really well for reporting, but what if I wanted to run a realtime search?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...