All Apps and Add-ons

Grouping log events to show uplink and down link traffic

nrelihan
Explorer

Hey,
I would like to couple two events together that would show the uplink and downlink traffic.
These two events would be in different location in the logs, depending on how long it takes the events to occur.

"10.159.216.131","61096/UDP","10.4.4.34","53/UDP (DNS)","Serial2/0.101","GigabitEthernet0
"10.4.4.34","53/UDP (DNS)","10.159.216.131","61096/UDP","GigabitEthernet0/1","Serial2

I have tried using the transaction funtion, to no avail, any suggestions on how this would be achieved?

Thanks alot.

Neil

Tags (1)
0 Karma

bobbyfaber
Explorer

Maybe you can give us some more detail? Have you named these fields?
It appears that if the port number (61096/UDP) is extracted in both cases (perhaps as 'port') one could do:

transaction port

or

stats port

Depending on the rest of the data, some other massaging may be needed.

0 Karma

nrelihan
Explorer

Yeah sorry, the first and second IP addresses are parsed as src and dst IPs. The "61096/UDP" field as src_port and 53/UDP (DNS) as dst_port.
The problem with doing "transaction dst_port src_port" for instance is that it comes back with multiple events that posses these fields, but what I require is to have the uplink and down link grouped together.
Cheers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...