Splunk Search

Need Help Restricting Results

menkurau
Path Finder

I am trying to provide our data center customers a view of their firewall permits and denies (based on cisco fwsm logs). The requirements I have been given are to restrict what a customer can search for to either events for their source or destination and by period of time the own the IP. Also, this cannot be a separate app. I need to figure out a way to restrict certain events to certain users based on the source and destination IP and time.

I have a lookup file that specifies a subnet for CIDR matching and has columns for mapping ownership to a customer by IP. The lookup also has a column to reference a date code for both the source and destination IP so I can exclude results by event time.

I have a search that fulfills the requirements, however, I can't figure out a way to restrict results by role. It is a pipeline search, so I can't create an eventtype. My understanding of summary indicies preclude their use. My thinking is the only way to do it is to create an app, but the requirements specify no.

Here is an example of one of the searches:

owner_src="FAC" OR owner_dst="FAC" type="Built" OR type="Deny" 
| convert timeformat="%m%d%y" ctime(_time) as c_time 
| eval owner_valid_src = if(c_time >= date_filter_src, "Yes", "No") 
| eval owner_valid_dst = if(c_time >= date_filter_dst, "Yes", "No") 
| search owner_valid_src="yes" OR owner_valid_dst="yes"
Tags (1)

dart
Splunk Employee
Splunk Employee

I think you want to convert your lookup to be an automatic time based lookup, and then use the search filter in the role for each customer on the owner_src and owner_dst fields. That way you do not need the convert, evals and 2nd search.

0 Karma

menkurau
Path Finder

Currently four, but there are likely to be more as we add new customers.

0 Karma

jonuwz
Influencer

How many roles will this scale to ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...