Splunk Search

Problem with Cisco ASA search query (iplocation)

madstylex
New Member

Hi,

I have a search string that shows the top 20 security related events by country on my Cisco ASA.

eventtype=cisco-security-events | iplocation src_ip | stats count by Country | sort 20 - count

It works well and displays the countries and total number of events for whichever time range I've specified.

However, when I want to click an individual country (Australia) and view the events, Splunk returns "No Results Found". Even though there are 8000+ events for Australia

A manual search also shows no results found:

eventtype=cisco-security-events  Country=Australia | iplocation src_ip

Can someone please explain why this is happening and kindly offer a solution?

Thanks Ninjas!

0 Karma

maciep
Champion

The problem is likely that the Country field doesn't exist until the iplocation command creates it. So for your manual, search, does something like this work?

eventtype=cisco-security-events | iplocation src_ip | where Country="Australia"
0 Karma

madstylex
New Member

That manual search does indeed work. Any idea on how to view the events by clicking through the results of my top 20 search?

0 Karma

maciep
Champion

Splunk tries to figure out how to drill down on its own, but doesn't always do a good job. If this is in a dashboard, Splunk allows you to configure how that works. I included some links below.

But I wonder if you change your base search to something like this, whether Splunk will add the country condition to a later spot in the search when drilling down for you?

 eventtype=cisco-security-events | iplocation src_ip | search Country=* | stats count by Country | sort 20 - count

http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/Understandbasictableandchartdrilldownactions

http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms

0 Karma

ndoshi
Splunk Employee
Splunk Employee

I just tested your idea of eventtype=cisco-security-events | iplocation src_ip | search Country=* | stats count by Country | sort 20 - count and that seems to work for a drilldown with iplocation without having to do anything more.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...