Splunk Search

transaction to group events based on machine on and off time. cisco ASA

baylor
New Member

Basically, I need to group my 2 events (built and teardown) in cisco ASA format by 2 fields (event,duration) the event field created will show no. of events combined which would be 2 (machine login and connection break). The duration field will show the total connection duration.

duration = Time for breakdown event - connection built event.
I tried stats and some other transactions but its not working. please advise.

sample data:
1. built event: Aug 7 15:47:23 10.1.1.99 Aug 07 2007 15:47:23 10.1.1.99 : %ASA-6-302013: Built inbound TCP connection 3120967 for outside:64.18.2.105/46303 (64.18.2.105/46303) to inside:192.168.1.150/25 (69.8.158.110/25)

  1. breakdown event: Aug 7 15:47:25 10.1.1.99 Aug 07 2007 15:47:25 10.1.1.99 : %ASA-6-302014: Teardown TCP connection 3120967 for outside:64.18.2.105/46303 to inside:192.168.1.150/25 duration 0:00:01 bytes 450 TCP FINs What is the best way to do this?
Tags (2)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

If you have the Splunk Add-on for Cisco ASA installed, you should be able to

index=... sourcetype=... 
| transaction maxspan=1h startswith=Cisco_ASA_message_id=302013 endswith=Cisco_ASA_message_id=302014  session_id 

If you do not have the Splunk Add-on for Cisco ASA installed - well, I suggest installing it.

Seriously, though - for just your little piece you could probably rex up your own session_id. Here I went crazy with MY* for that (so it wouldn't conflict with what the Add-on is already doing)

index=... sourcetype=...
| rex "(?<MYmessage_id>\d+):\s+(Built|Teardown)\s+(outbound\s+)?TCP\sconnection\s(?<MYsession_id>\d+)"
| transaction maxspan=1h startswith=MYmessage_id=302013 endswith=MYmessage_id=302014 MYsession_id

Those both give you a free duration and eventcount fields. Well, they are not actually free, it costs the price of running it as transaction instead of stats.

To use stats (broken up a bit for readability)...

index=network sourcetype=cisco:asa 
| stats earliest(_time) AS startTime, latest(_time) AS endTime, count(_time) as eventcount,
    list(src_ip) as src_ip, list(dest_ip) as dest_ip, list(dest_port) as dest_port BY session_id
| eval duration=endTime - startTime

You can list more things in the stats section or you could use something other than list and so on, but that should give you the idea. It calculates a duration and an eventcount for you.

Happy Splunking!
-Rich

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

If you have the Splunk Add-on for Cisco ASA installed, you should be able to

index=... sourcetype=... 
| transaction maxspan=1h startswith=Cisco_ASA_message_id=302013 endswith=Cisco_ASA_message_id=302014  session_id 

If you do not have the Splunk Add-on for Cisco ASA installed - well, I suggest installing it.

Seriously, though - for just your little piece you could probably rex up your own session_id. Here I went crazy with MY* for that (so it wouldn't conflict with what the Add-on is already doing)

index=... sourcetype=...
| rex "(?<MYmessage_id>\d+):\s+(Built|Teardown)\s+(outbound\s+)?TCP\sconnection\s(?<MYsession_id>\d+)"
| transaction maxspan=1h startswith=MYmessage_id=302013 endswith=MYmessage_id=302014 MYsession_id

Those both give you a free duration and eventcount fields. Well, they are not actually free, it costs the price of running it as transaction instead of stats.

To use stats (broken up a bit for readability)...

index=network sourcetype=cisco:asa 
| stats earliest(_time) AS startTime, latest(_time) AS endTime, count(_time) as eventcount,
    list(src_ip) as src_ip, list(dest_ip) as dest_ip, list(dest_port) as dest_port BY session_id
| eval duration=endTime - startTime

You can list more things in the stats section or you could use something other than list and so on, but that should give you the idea. It calculates a duration and an eventcount for you.

Happy Splunking!
-Rich

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...