Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jcrochon
jcrochon
Explorer
Member since:
08-13-2013
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 08-13-2013 |
Activity Feed
- Karma Re: Show all buckets of _time in visualization including zero counts for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: How to define a constant variable for internal IP addresses for all apps and searching? for diogofgm. 06-05-2020 12:49 AM
- Karma Re: How to define a constant variable for internal IP addresses for all apps and searching? for diogofgm. 06-05-2020 12:49 AM
- Karma Re: How to search for Top 2-way communicators using top src_ip,dest_ip to find top dest_ip,src_ip? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How to search for Top 2-way communicators using top src_ip,dest_ip to find top dest_ip,src_ip? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How to search for Top 2-way communicators using top src_ip,dest_ip to find top dest_ip,src_ip? for somesoni2. 06-05-2020 12:49 AM
- Posted Re: How to define a constant variable for internal IP addresses for all apps and searching? on Splunk Search. 08-09-2018 09:59 AM
- Posted Re: How to define a constant variable for internal IP addresses for all apps and searching? on Splunk Search. 08-09-2018 06:14 AM
- Posted Re: How to define a constant variable for internal IP addresses for all apps and searching? on Splunk Search. 08-09-2018 06:06 AM
- Posted Re: How to define a constant variable for internal IP addresses for all apps and searching? on Splunk Search. 08-08-2018 02:26 PM
- Posted How to define a constant variable for internal IP addresses for all apps and searching? on Splunk Search. 08-07-2018 03:20 PM
- Tagged How to define a constant variable for internal IP addresses for all apps and searching? on Splunk Search. 08-07-2018 03:20 PM
- Tagged How to define a constant variable for internal IP addresses for all apps and searching? on Splunk Search. 08-07-2018 03:20 PM
- Tagged How to define a constant variable for internal IP addresses for all apps and searching? on Splunk Search. 08-07-2018 03:20 PM
- Tagged How to define a constant variable for internal IP addresses for all apps and searching? on Splunk Search. 08-07-2018 03:20 PM
- Tagged How to define a constant variable for internal IP addresses for all apps and searching? on Splunk Search. 08-07-2018 03:20 PM
- Posted How to send an IP and MAC address to a router filter file on Getting Data In. 07-30-2018 05:37 PM
- Tagged How to send an IP and MAC address to a router filter file on Getting Data In. 07-30-2018 05:37 PM
- Tagged How to send an IP and MAC address to a router filter file on Getting Data In. 07-30-2018 05:37 PM
- Tagged How to send an IP and MAC address to a router filter file on Getting Data In. 07-30-2018 05:37 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-09-2018
09:59 AM
Thanks again for all the help.
... View more
08-09-2018
06:14 AM
P. S. What if I wanted to switch from local src_ip to dest_ip?
Would this work:
dest_ip=[| inputlookup local_ips.csv]
... View more
08-08-2018
02:26 PM
Is there an option in the interface to define this?
... View more
07-30-2018
05:37 PM
I’m moving from custom software that writes a snort alert to a file that would filter the device on a router.
I’m not sure where to start but I’m hoping that there is a command line like “sendalert /var/log/$mac-$ip-filter.log” that will be processed upstream to the router by a cron job.
I would also like that a right-click on a Splunk search output to extract the same data and write to the file.
... View more
07-24-2018
01:41 PM
Added better stats (single src to multiple dest):
source="/var/log/alerts.log" [ search source="/var/log/alerts.log" dest_ip="192.168.*") | top src_ip,dest_ip | table dest_ip | rename dest_ip as src_ip ] | stats values(dest_ip),values(name),count(name) by src_ip | sort - count(name)
... View more
07-24-2018
09:43 AM
One caveat, remove the dest_ip="192.168.*" from the secondary search due to search collisions, such as src_ip="192.168.*" && dest_ip="192.168.*"
source="/var/log/alerts.log" [ search source="/var/log/alerts.log" dest_ip="192.168.*" | top src_ip,dest_ip | table dest_ip | rename dest_ip as src_ip ] | top dest_ip,src_ip
... View more
07-24-2018
07:26 AM
That worked as expected. I would like to give you credit if you can make this an answer instead of a comment.
... View more
07-23-2018
04:08 PM
Thank you for the clarification. I need to learn more about how searching works. I was trying to use temp vars as in programming.
... View more
07-23-2018
01:48 PM
Added swap of src_ip as new destination:
source="/var/log/alerts.log" dest_ip="192.168.*" [ search source="/var/log/alerts.log" dest_ip="192.168.*" | top src_ip,dest_ip | rename src_ip AS newDest | table newDest ] | rename dest_ip AS newSrc | top newSrc,newDest
... View more
07-23-2018
01:23 PM
Hello all,
I have some IDS alerts "top src_ip,dest_ip" in which I want to see if the dest_ip is contacting the src_ip's. This would lead me to investigate the communications between the 2 IP's, else if the dest_ip is not communicating back, I would ignore and move on.
Top Src_IP (Internet) -> Top Dest_IP (Local) | HitCount
**1.2.3.4** -> 192.168.1.2 | 254
**4.3.2.1** -> 192.168.1.4 | 245
Lookup Table (Src_IP)
**1.2.3.4**
**4.3.2.1**
Search question: Is the Top Dest_IP's (Local) contacting back to Lookup Table Src_IP's (Internet):
Top Dest_IP (*aka new Src_IP*) -> Top Src_IP (* aka new Dest_IP*) | HitCount
192.168.1.2 -> **1.2.3.4** | 20
192.168.1.4 -> **4.3.2.1** | 30
I have been working with something like this: source="/var/log/alerts.log" dest_ip="192.168.*" [ search source="/var/log/alerts.log" dest_ip="192.168.*" | top src_ip,dest | table src_ip ] | top dest_ip,src_ip
I'm not getting any results -- I humbly assume it's my error -- I should be seeing some communication back.
Please double-check my design and thank you for all the help.
... View more
09-05-2017
02:51 PM
Hello Splunker,
I'm trying to display a 'timestamp, event count' visualization including counts of zero events
host="[redacted]" src_port=* | bucket _time span=1h | stats count by _time | eval _time=strftime(_time, "%Y-%m-%d %H:%M")
Results
2017-09-05 12:00 2
2017-09-05 13:00 1
2017-09-05 16:00 1
Expected Results
2017-09-05 12:00 2
2017-09-05 13:00 1
2017-09-05 14:00 0
2017-09-05 15:00 0
2017-09-05 16:00 1
... View more
