stats count help

[hermeslxxv]

I am pulling syslogs and attempting to count IPs that are blocked for abuse. My counts are coming up 0. the IP used has been banned by two devices in the last 48hrs, and more than once in one of the devices. here is my xml search query so far;

index=aaa source=tcp:5146 NetworkDeviceName=*SOME-ROUTER* BAD-CUST 10.20.30.40 AND NOT "no ip prefix-list" AND NOT "show ip prefix-list" AND NOT "do sh" | rex field=CmdSet mode=sed "s/\[ CmdAV=//g" | rex field=CmdSet mode=sed "s/\]//g" | rex field=CmdSet "permit (?<dvc_ip>\d+\.\d+\.\d+\.\d+)\/32" | rename dvc_ip as "IP Blocked" | stats count(eval(method="48HRs")) AS 48HRs BY "IP Blocked" NetworkDeviceName 

and the result im trying to achieve;

IP blocked NetworkDeviceName 48HRs
10.20.30.40 one-some-router 2
10.20.30.40 two-some-router 1

Thanks for any suggestions

[meenal901]

method field is missing. Can you check once by backtracing before rex and printing out method. Rex looks fine to me, but do check the results once.
Backtracing is the only way to debug your queries 🙂

[martin_mueller]

Additionally to backtracking commands, I'd recommend using search or where commands to filter for the method value rather than stuffing too much logic into stats - that quickly becomes hard to debug.

[woodcock]

Either your method field or your dv_ip field is not there. Back of your commands from the end one-by-one until you see stuff that works and then figure out why the stuff you just stripped isn't working. Probably bad RegEx.

[richgalloway]

Can you share some sample events?

[hermeslxxv]

something specific that would help? the CmdSet field is what im searching against, in this case it is identical for all the events aside from a time stamp and the device name.

Feb 15 02:05:29,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=ONE-SOME-ROUTER
Feb 15 02:05:29,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=TWO-SOME-ROUTER
Feb 10 04:02:11,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=ONE-SOME-ROUTER