×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
jpena323
Explorer
Member since: ‎01-05-2015
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 4
Member Since ‎01-05-2015
Activity Feed
View All

correlate multiple destination fields based on sin...

by in Splunk Search
‎04-02-2015 12:38 PM
2 Karma
‎04-02-2015 12:38 PM
2 Karma
Hi guys, Would really appreciate your help looking for a splunk search to do some reporting/alerting for me based on my firewall logs... specifically having issues with correlating a single source field (such as IP address or hostname) to multiple other field counts (such as port or username). I know there has to be a way to accomplish this but i've tried joins/appendpipe/and others with no luck... Example of what I'm trying to accomplish: Top list of source IP addresses hitting deny ACLs to multiple ports and total hits (such as someone scanning our network). Source_IP - Source_Country - Total_Denies - Total_Port_Attempted 1.2.3.4 - - - - - - - - China - - - - - - - - 1678 - - - - - - - - - 64 9.8.7.6 - - - - - - - - Ukraine - - - - - - -1204 - - - - - - - - - 76 4.2.3.2 - - - - - - - - Netherlands - - - - 804 - - - - - - - - - - 4 Here is what I got so far: sourcetype="juniper" reason="policy deny" src_zone="UNTRUST" | lookup geoip clientip as src_ip | stats dc(dest_port) as Total_Port_Attempted by src_ip,client_country Problem here is that I lose the total count 😞 ...I've tried to get creative with the stats command but keep getting repeated group-by field error messages. Would be nice to even throw in a Total_DestIP_Attempted... Any help is much appreciated! Thanks! P.S. Here is an example log entry: *Apr 2 12:29:02 labsrx2 1 [src-ip="11.67.18.25" src-port="57900" dest-ip="11.21.8.188" dest-port="44256" type="TCP" policy="GLOBAL_DENY_LOG(global)" src-zone="UNTRUST" dest-zone="UNTRUST" reason="policy deny"] ... View more

Re: How to configure SEDCMD in props.conf?

by in Getting Data In
‎01-21-2015 09:05 AM
‎01-21-2015 09:05 AM
thanks - im going to try to add this to the indexer and see if it works ... View more

How to configure SEDCMD in props.conf?

by in Getting Data In
‎01-21-2015 06:48 AM
2 Karma
‎01-21-2015 06:48 AM
2 Karma
Hi guys, I am having a really hard time figuring out how to get the sedcmd to work in props.conf. I'd appreciate any help you can lend. Here is an example of my config: PROPS.CONF [source::.../syslog_logs/*srx*/user.info.log] SEDCMD-removeunwanted1 = s/\s(src-nat-rule-name=\"[^\"]+\")// SEDCMD-removeunwanted2 = s/\s(source-zone-name=\"[^\"]+\")// SEDCMD-removeunwanted3 = s/\s(destination-zone-name=\"[^\"]+\")// SEDCMD-alter1 = s/destination/dst/g SEDCMD-alter2 = s/source/src/g SEDCMD-alter3 = s/address/ip/g SEDCMD-alter4 = 's/protocol-id="17"/UDP/' SEDCMD-alter5 = 's/protocol-id="6"/TCP/' SEDCMD-alter6 = 's/protocol-id="1"/ICMP/ The point of this is to simplify our logs from Juniper SRXs. When I do a "--debug props list | grep SEDCMD", I see the commands listed. Not sure what I'm doing incorrectly, but have a couple of questions in addition to any advice you guys have. 1.) Does this props.conf have to be configured on the forwarder or the indexer? I'd prefer to do this on the forwarder if possible. 2.) Does restarting the splunk forwarder engage the changes? Or is there something else I need to do? 3.) Is there any way to monitor logs as they come into splunk? (similar to tail -f) 4.) Do you see anything wrong with my syntax? Thanks in advance guys! I really appreciate the help! ... View more

ignore specific parts of a log entry with props.co...

by in Getting Data In
‎01-05-2015 08:35 AM
‎01-05-2015 08:35 AM
Hi Splunkers! Thank you so much for your help in advance! I'm trying to ignore specific fields within a syslog entry from being forwarded to Splunk. This can not be done on the host level so I was looking towards the props/transforms for help. Unfortunately, I can not figure this one out. I have a single line log entry from a Juniper SRX: Dec 31 07:55:25 srx1 1 2014-12-31T07:55:25.244 srx1a RT_FLOW - RT_FLOW_SESSION_CREATE [[email protected] source-address="10.170.72.52" source-port="51888" destination-address="10.5.80.36" destination-port="10050" service-name="None" nat-source-address="10.170.72.52" nat-source-port="51885" nat-destination-address="10.5.80.36" nat-destination-port="10050" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="6" policy-name="TRUST-VPN-PERMIT" source-zone-name="TRUST" destination-zone-name="VPN" session-id-32="120129546" username="N/A" roles="N/A" packet-incoming-interface="reth1.104" application="UNKNOWN" nested-application="UNKNOWN" encrypted="UNKNOWN"] That's a giant entry (I have lots of them!) and I'd like to eliminate specific fields that we have aren't interested in (i.e. "src-nat-rule-name="None") but keeping the rest of the log entry. Is this possible? I think specifying any field with regex will match (and null out) the entire line and that's not what I want. My files for reference: props.conf [source::/syslog/srx1/user.info.log] TRANSFORMS-set= setnull transforms.conf [setnull] REGEX = (?:source-zone.? |session-id.? |src-nat-rule-name.? |junos@.? |destination-zone.? |username.? |roles.? |packet-incoming.? |application.? |nested-application.? |encrypted.*? |RT_FLOW - ) DEST_KEY = queue FORMAT = nullQueue ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
Karma given to
View All