Greetings, I am trying to output an IP address from a search to a script. My goal is to have the search call a script to block IP it finds. Below is my search and an example of its results. My Search: host="192.168.4.1" UTM5 Login failed: | stats count by src_ip | where count >3 | return src_ip Returns: src_ip="192.168.4.23" How do I pass the src_ip from my search to a script I am calling? Or do I have to write it to a separate file? ... View more

Greetings, I am trying to setup up Splunk to count the failed login attempts on our firewall and then run a script that will login to the firewall and block said IP address. Currently, I have it setup to capture failed login attempts and run the default script (echo.sh) for testing purposes. My questions is, how do I count and pass the IP address after “from” in the log below? Dec 27 15:37:36 192.168.4.1 seclogin: [2012 Dec 27 15:37:36] UTM5 Login failed: invalid user sdhsdh from 192.168.4.3 Do I have to create a field type or use the field extractor? How does either, affect Splunks outputs listed here: http://docs.splunk.com/Documentation/Splunk/5.0.1/Alert/Configuringscriptedalerts ... View more