Splunk Search

stats count help

hermeslxxv
Engager

I am pulling syslogs and attempting to count IPs that are blocked for abuse. My counts are coming up 0. the IP used has been banned by two devices in the last 48hrs, and more than once in one of the devices. here is my xml search query so far;

index=aaa source=tcp:5146 NetworkDeviceName=*SOME-ROUTER* BAD-CUST 10.20.30.40 AND NOT "no ip prefix-list" AND NOT "show ip prefix-list" AND NOT "do sh" | rex field=CmdSet mode=sed "s/\[ CmdAV=//g" | rex field=CmdSet mode=sed "s/\]//g" | rex field=CmdSet "permit (?<dvc_ip>\d+\.\d+\.\d+\.\d+)\/32" | rename dvc_ip as "IP Blocked" | stats count(eval(method="48HRs")) AS 48HRs BY "IP Blocked" NetworkDeviceName 

and the result im trying to achieve;

IP blocked NetworkDeviceName 48HRs
10.20.30.40 one-some-router 2
10.20.30.40 two-some-router 1

Thanks for any suggestions

Tags (3)
0 Karma

meenal901
Communicator

method field is missing. Can you check once by backtracing before rex and printing out method. Rex looks fine to me, but do check the results once.
Backtracing is the only way to debug your queries 🙂

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Additionally to backtracking commands, I'd recommend using search or where commands to filter for the method value rather than stuffing too much logic into stats - that quickly becomes hard to debug.

0 Karma

woodcock
Esteemed Legend

Either your method field or your dv_ip field is not there. Back of your commands from the end one-by-one until you see stuff that works and then figure out why the stuff you just stripped isn't working. Probably bad RegEx.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you share some sample events?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

hermeslxxv
Engager

something specific that would help? the CmdSet field is what im searching against, in this case it is identical for all the events aside from a time stamp and the device name.

Feb 15 02:05:29,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=ONE-SOME-ROUTER
Feb 15 02:05:29,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=TWO-SOME-ROUTER
Feb 10 04:02:11,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=ONE-SOME-ROUTER

0 Karma