Splunk Search

How to perform advanced event correlation

michael_bates_1
Path Finder

Evening All,

I am currently collecting a feed of syslog messages from a RADIUS platform.
I need to be able to detect the condition where;

  • A RADIUS start message is received (message A)
  • Find the previous message for the IP address in message A (message B)
  • Check if the RADIUS type in message B is not a STOP
I have been investigating transactions, but this does not seem able to capture the events that I need. Looked into streamstats, and this appears on the surface to be the correct function, but it does not return the correct results.

Search thus far;

index="radius" | streamstats current=f last(messageType) as previousType |
table _time,IP,messageType,sessionID,previousType

This is not returning the previous message for the IP in question. If I add the by clause to the streamstats command, the whole search stops returning results.

Any ideas/thoughts most welcome.

Michael Bates

Ayn
Legend

The streamstats command operates on events as they arrive as search results. Since Splunk searches by default return the most recent events first, that means that the last messageType value relative to an event is actually the one happening AFTER that event in time rather than before it. (This is not the case for real-time searches, as events arrive in chronological order.)

To have events return to streamstats in chronological order instead, just use reverse.

Other ways of finding the last messageType could include a combination of the map and localize commands for finding the "base event" and then search events in its vicinity to get other information, such as the previous messageType in your case. If you decide not to go for the streamstats approach, have a look at the docs for these commands: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Localize and http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...