All Apps and Add-ons

Unix App - Report on Differences in Open Ports

aferone
Builder

We have the *NIX app working, and as an example, we have one system feeding netstat and open port data into it. We are feeding this data every hour. How can I send an alert if the reports each hour don't match? Basically, if a new port is opened, or an existing port is closed, we want to get an alert.

Thanks for the help, as always!

2 Solutions

araitz
Splunk Employee
Splunk Employee

Try the diff command:

http://docs.splunk.com/Documentation/Splunk/latest/Searchreference/Diff

index=os sourcetype=netstat host=your_host | head 2 | diff

View solution in original post

0 Karma

aferone
Builder

Thank you for the answer!

Now, I am trying to create a alert for this. Under normal conditions, I get the "** Results are the Same **" message. However, when there is a difference, for example, I get this:

@@ -15,3 +15,4 @@
udp 52480
udp 20031
udp 5353
+udp 1514

I am trying to set up the alert so that obviously it only send us an email when there is a difference. I tried using the custom condition in the alert to exclude the "** Results are the Same **" message, but it is not working.

Any suggestions? Thanks again!

View solution in original post

0 Karma

aferone
Builder

Thank you for the answer!

Now, I am trying to create a alert for this. Under normal conditions, I get the "** Results are the Same **" message. However, when there is a difference, for example, I get this:

@@ -15,3 +15,4 @@
udp 52480
udp 20031
udp 5353
+udp 1514

I am trying to set up the alert so that obviously it only send us an email when there is a difference. I tried using the custom condition in the alert to exclude the "** Results are the Same **" message, but it is not working.

Any suggestions? Thanks again!

0 Karma

aferone
Builder

This worked perfectly. Thank you!

0 Karma

araitz
Splunk Employee
Splunk Employee

I think you can filter no-diffs out by adding one of the following to your search:

... | search linecount > 2
... | search NOT "Results are the Same"
0 Karma

araitz
Splunk Employee
Splunk Employee

Try the diff command:

http://docs.splunk.com/Documentation/Splunk/latest/Searchreference/Diff

index=os sourcetype=netstat host=your_host | head 2 | diff
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...