Splunk Search

Match rows based on matching fields (src_port + dest_port)

jackhamm25
Explorer

I'm having a little problem with matching events. Basically, I collect flows from an IPFIX (NetFlow) collector and each row is one half of the total flow. I can get to the individual lines, but I can't bind the two together. I've tried transaction, but it doesn't seem to work.

I'm basically looking to match the situation where src_port[row1] == dest_port[row2] and src_ip[row1] == dest_ip[row2]

Here's what I can do -- I just want to match each of the rows together -or- if there is no match, just show the single row:

index=ipfix 
| eval srcp=mvindex(src_port,0) 
| eval destp=mvindex(dest_port,0) 
| stats count(tcp_seq_num) as seqcnt by src_ip, dest_ip, srcp, destp
| table seqcnt, srcp, destp, src_ip, dest_ip

seqcnt      srcp     destp      src_ip          dest_ip
5           80       56311      77.234.41.24    10.10.10.10
4           56311    80         10.10.10.10     77.234.41.24
3           61860    80         10.10.11.11     5.153.253.76
3           80       61860      5.153.253.76    10.10.11.11
1           58731    53         10.10.11.12     8.8.8.8

Appreciate any help!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=ipfix 
 | eval srcp=mvindex(src_port,0) 
 | eval destp=mvindex(dest_port,0)
 | eval ip_addresses=mvsort(split(src_ip."#".dest_ip,"#"))
| stats list(srcp) as srcp list(destp) as destp list(src_ip) as src_ip list(dest_ip) as dest_ip count(tcp_seq_num) as seqcnt by ip_addresses
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...