Splunk Search

Can you help me with the following SPL: Index=fw_cisco

dkraut
Engager

Question on the following SPL:

 >  index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) by dest_ip dest_port

This works well, but I'd also like to include the protocol in the output, so I know if the port is TCP or UDP. I've tried different things but no luck.

Is that even possible using this SPL?

0 Karma

Vijeta
Influencer

You can write - index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) by dest_ip dest_port protocol

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are two ways to do that.

index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) by dest_ip dest_port protocol

index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) values(protocol) by dest_ip dest_port
---
If this reply helps you, Karma would be appreciated.
0 Karma

dkraut
Engager

Hi Rich, I had already tried the first one but it returns no statistics at all. The second one you suggested returns statistics, including a values(protocol) field, but that field is blank? Looking at the corresponding Event data I see strings in the entries for "stub TCP connection", "stub UDP connection" so the data seems to be there.

Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The fact that the first command returns nothing and the second returns an empty field tells me your data does not have a field called "protocol". It must be called something else. Look where you see "stub TCP connection" to get the correct field name.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...