Splunk Search

How do I sort and get a count for specific data?

sean_kirkpatric
Engager

I have the following search for my Cisco ASA

event_desc="Deny TCP (no connection) from IP_address/port to IP_address/port flags tcp_flags on interface interface_name."

How can I sort this search on the "to IP_address/port" and get a count of each?

Thanks

SK

Tags (4)
0 Karma
1 Solution

rturk
Builder

Hi Sean, try the following:

<base search> | rex field=event_desc "to (?<dst_ip_address>\d+\.\d+\.\d+\.\d+)/(?<dst_port>\d+)" | stats count by dst_ip_address, dst_port

If this doesn't work, if you could post an actual event I might be able to fine tune it for you.

Hope this helps 🙂

View solution in original post

0 Karma

sean_kirkpatric
Engager

Got it... I was missing a ? before . Thanks!

0 Karma

rturk
Builder

Glad I could help 🙂

0 Karma

rturk
Builder

Hi Sean, try the following:

<base search> | rex field=event_desc "to (?<dst_ip_address>\d+\.\d+\.\d+\.\d+)/(?<dst_port>\d+)" | stats count by dst_ip_address, dst_port

If this doesn't work, if you could post an actual event I might be able to fine tune it for you.

Hope this helps 🙂

0 Karma

sean_kirkpatric
Engager

Thanks. I removed field=event_desc, and I still get the matching events but no results found.

I have the Firewall app, but it doesn't give me all the info I need.

0 Karma

rturk
Builder

Ahhh... well in that case get rid of field=event_desc and you should be good.

Also, seeing as you're dealing with ASA logs, you might find the "Splunk for Cisco Firewalls" and "Cisco Security Suite" apps worth a look.

sean_kirkpatric
Engager

Thank you for you help. Unfortunately, the results come out empty. Splunk says it finds 1900+ matches though. Here is an actual event.

Sep 23 18:14:15 10.10.10.1 Sep 23 2013 18:16:15: %ASA-6-106015: Deny TCP (no connection) from 15.16.17.8/80 to 12.22.12.1/1398 flags FIN PSH ACK on interface outside

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...