Splunk Search

How do i group the log for ip, or type?

graidelak
New Member

Hi I want to know how can i group my log from my firewall by source ip, or dest_ip or type, because i want to make a report that show me the attack or events by groups.

Maybe is a stupid question but im just newbie using splunk and i want to learn how can i do that.

Thank you

Tags (1)
0 Karma

rogerdpack
Path Finder

query | chart by host

by important part being "by host"

0 Karma

graidelak
New Member

Im sorry if you couldn't understand me

I mean I want to do a report that tell me who attack me and which ip, things like that, but I have no idea how to group these events.

0 Karma

Ayn
Legend

You'd need to create fields out of your logs (covered in the tutorial, tl;dr: use the interactive field extractor in splunkweb), and then grab stats on the fields you mention (also covered in the tutorial). If you want to create a search form that only requires you to input an IP number and automatically get charts, tables etc, have a look at the "Build forms" section of the developer manual).

graidelak
New Member

Yeah I did but I can't group those events. Let me see if I can explain better.

I want to see my firewall log (watchguard) and make some search by src_ip or dest_ip and then a report to see how many deny, attack, or error i had.

I saw many apps for firewall but i didn't see one for watchguard firebox

0 Karma

Ayn
Legend

Did you take the Splunk tutorial? It's a great way to get past the "I'm very new to Splunk" phase.

0 Karma

melting
Splunk Employee
Splunk Employee

I am not sure I understand the question

If you want statistics then take a look here:

If you want these combined together, perhaps the transaction search cmd

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...