Splunk Search

Why does the _time value keeps coming up blank?

jon_d_irish_ctr
Path Finder

Hello,
I have the following search string, but "_time" keeps coming up blank. It appears that something is "clearing" it, but I can't figur eout what.

sourcetype=cisco:asa dest_ip="xxx.xxx.0.0/16" NOT "Failover primary closed" | stats count by src_ip,dest_ip | eval Connections = count | iplocation src_ip | where Country = "China" OR Country = "Iran" OR Country = "Iraq" OR Country = "Russia" OR Country = "Brazil" OR Country = "North Korea" | lookup dnsLookup ip as src_ip | eval ExtFQDN=if(isnotnull(host),host,src_ip) | eval ExtIPCity=if(City="","Not available",City) | eval ExtIPRegion=if(Region="","Not available",Region) | table Country ExtIPRegion ExtIPCity src_ip ExtFQDN dest_ip Connections _time | dedup src_ip dest_ip

Thanks,
Jon

Tags (2)
0 Karma
1 Solution

niketn
Legend

@jon.d.irish.ctr, try the following search. Change the span (which is 1m) as per time aggregation that you need.

sourcetype=cisco:asa dest_ip="xxx.xxx.0.0/16" NOT "Failover primary closed" 
| bin _time span=1m 
| stats count by src_ip,dest_ip,_time 
| eval Connections = count 
| iplocation src_ip 
| where Country = "China" OR Country = "Iran" OR Country = "Iraq" OR Country = "Russia" OR Country = "Brazil" OR Country = "North Korea" 
| lookup dnsLookup ip as src_ip 
| eval ExtFQDN=if(isnotnull(host),host,src_ip) 
| eval ExtIPCity=if(City="","Not available",City) 
| eval ExtIPRegion=if(Region="","Not available",Region) 
| table Country ExtIPRegion ExtIPCity src_ip ExtFQDN dest_ip Connections _time 
| dedup src_ip dest_ip
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

jon_d_irish_ctr
Path Finder

Thanks for the comments everyone! I did get it working using nikenilay's example.

0 Karma

niketn
Legend

@jon.d.irish.ctr, try the following search. Change the span (which is 1m) as per time aggregation that you need.

sourcetype=cisco:asa dest_ip="xxx.xxx.0.0/16" NOT "Failover primary closed" 
| bin _time span=1m 
| stats count by src_ip,dest_ip,_time 
| eval Connections = count 
| iplocation src_ip 
| where Country = "China" OR Country = "Iran" OR Country = "Iraq" OR Country = "Russia" OR Country = "Brazil" OR Country = "North Korea" 
| lookup dnsLookup ip as src_ip 
| eval ExtFQDN=if(isnotnull(host),host,src_ip) 
| eval ExtIPCity=if(City="","Not available",City) 
| eval ExtIPRegion=if(Region="","Not available",Region) 
| table Country ExtIPRegion ExtIPCity src_ip ExtFQDN dest_ip Connections _time 
| dedup src_ip dest_ip
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

elliotproebstel
Champion

After this part of your query:

| stats count by src_ip,dest_ip

you will be left with three fields: count, src_ip, and dest_ip. If you want _time to persist through this part of the query, you'll need to restructure it somehow. Given that you're trying to count by src_ip and dest_ip but want to retain timestamps, you might find it helpful to do this instead:

| eventstats count by src_ip,dest_ip
| fields src_ip dest_ip _time count
...

That will retain the _time field and also narrow down the fields to the four you need - the three you had before, plus _time.

0 Karma

knielsen
Contributor

You are clearing it here: | stats count by src_ip,dest_ip - after that, you only have count, src_ip and dest_ip

Regards,
-Kai.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...