Splunk Search

Need Help Restricting Results

Path Finder

I am trying to provide our data center customers a view of their firewall permits and denies (based on cisco fwsm logs). The requirements I have been given are to restrict what a customer can search for to either events for their source or destination and by period of time the own the IP. Also, this cannot be a separate app. I need to figure out a way to restrict certain events to certain users based on the source and destination IP and time.

I have a lookup file that specifies a subnet for CIDR matching and has columns for mapping ownership to a customer by IP. The lookup also has a column to reference a date code for both the source and destination IP so I can exclude results by event time.

I have a search that fulfills the requirements, however, I can't figure out a way to restrict results by role. It is a pipeline search, so I can't create an eventtype. My understanding of summary indicies preclude their use. My thinking is the only way to do it is to create an app, but the requirements specify no.

Here is an example of one of the searches:

owner_src="FAC" OR owner_dst="FAC" type="Built" OR type="Deny" 
| convert timeformat="%m%d%y" ctime(_time) as c_time 
| eval owner_valid_src = if(c_time >= date_filter_src, "Yes", "No") 
| eval owner_valid_dst = if(c_time >= date_filter_dst, "Yes", "No") 
| search owner_valid_src="yes" OR owner_valid_dst="yes"
Tags (1)

Splunk Employee
Splunk Employee

I think you want to convert your lookup to be an automatic time based lookup, and then use the search filter in the role for each customer on the owner_src and owner_dst fields. That way you do not need the convert, evals and 2nd search.

0 Karma

Path Finder

Currently four, but there are likely to be more as we add new customers.

0 Karma


How many roles will this scale to ?

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...