Splunk Search

How do I search the network data model to track certain ports?

Mitchellsch
Explorer

I'm very new to searching data models in Splunk and I want to search within my network data model to monitor certain ports. I know I can use the All_traffic.dest_port, but I can't figure out how to make it work. I want dashboards to track failed and successful logins on devices by tracking these ports. So, I need to track ssh logins on port 22 and rdp logins on 3389. Then I want to create a notable event from this search which I know how to create. I just need help using the data model since I'm new to data models. Thanks.

0 Karma

sobrien
Splunk Employee
Splunk Employee

Hi Mitchell,

A good approach for this is to use the pivot interface, which you can access from settings -> data models -> pivot. In this interface, you can specify the filter or search fields you want, to display the output you are looking for. From there, there is an 'open in search' button that would show you the search string that was used to generate the output. This search string will be based on the 'pivot' command. It will look something like:

| pivot Network_Traffic All_Traffic count(All_Traffic) AS "Count of All Traffic" SPLITROW action AS action FILTER dest_port = 22 SORT 100 action ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1

Another option is to look at the 'datamodel' search command:

| datamodel [] [<object>] []

This is documented here: http://docs.splunk.com/Documentation/Splunk/6.1.9/SearchReference/Datamodel

HTH.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...