Splunk Search

How to set up an alert to trigger if any values change for 3 fields from the last scan and now?

kiran331
Builder

Hi all,

From a scan report of Qualys, I will get IP and its PORT, TCP_PORT, UDP_PORT. Now when the scan is done after a week, if there is any change in PORT or TCP_PORT or UDP_PORT values, an alert should be triggered. Is there a way of comparing the two results?

for Example:

index="abc" IP=10.22.23.3 | table  LAST_SCAN_DATETIME, PORT, TCP_PORT,  UDP_PORT

IP=10.22.23.3
LAST_SCAN_DATETIME      
2016-06-05T06:32:42Z    ,  PORT - 8808, 2022.   TCP_PORT-135    UDP_PORT-123

2016-05-08T06:52:25Z       PORT - 8808. TCP_PORT-135    UDP_PORT-123    

A new port is added on 2016-06-05T06:32:42Z. How can I create an alert if there is any change in the values of these three fields?

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Do you only want an alert if the last two scans are different?

If so try this:

 index="abc" IP=10.22.23.3 | head 2 | table PORT | transpose | where 'row 1'!='row 2'

For 3 or more past events, this solution becomes more difficult:

 index="abc" IP=10.22.23.3 | head 3 | table PORT | transpose | where 'row 1'!='row 2' OR 'row 1'!='row 3' OR 'row 2'!='row 3'     

View solution in original post

0 Karma

sundareshr
Legend

Try this

index="abc" IP=10.22.23.3 | timechat span=1d  dc(PORT) as Port  dc(TCP_PORT) as TCP  dc(UDP_PORT) as UDP | delta Port | delta TCP | delta UDP | addtotals | where Total!=0
0 Karma

jkat54
SplunkTrust
SplunkTrust

Do you only want an alert if the last two scans are different?

If so try this:

 index="abc" IP=10.22.23.3 | head 2 | table PORT | transpose | where 'row 1'!='row 2'

For 3 or more past events, this solution becomes more difficult:

 index="abc" IP=10.22.23.3 | head 3 | table PORT | transpose | where 'row 1'!='row 2' OR 'row 1'!='row 3' OR 'row 2'!='row 3'     
0 Karma

kiran331
Builder

Thanks! Yes, i want an alert based on the last scan, But here i have 100+ of IP's and can i use more attributes PORT, TCP_PORT and UDP_PORT.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...