Splunk Search

Combining multiple events

PowerBlade
New Member

Hi

I have a question to how I do a report based on multiple events.
In this particular case, I started logging from our Cisco Wireless Lan Controller. I receive multiple AP association and disassociation events.
I can easily query to find the disassociation events and I can also easily query for association events.
But I'm having a problem how to form a query to combine the events. I want 2 different reports.
1) Get a list of access points that sent a disassociation event but no association events after that. (disappeared from the network)
2) Get a list of access points that sent an association event with no disassociation event before that (say within the last 24 hours) - (New access points added to the network)

Example to query for an disassociation event:

index=wireless bsnAPDisassociated | rex "bsnAPName.0 = STRING: \"(?<apname>\S+)\""

Example to query for an association event:

index=wireless ciscoLwappApMIBNotifs.4 | rex "cLApName.'\S+' = STRING: (?<apname>\S+)"

I will appreciate any hints I can get to solve my problem.

0 Karma

lguinn2
Legend

Here is a start - what time range do you intend to search?

index=wireless bsnAPDisassociated OR ciscoLwappApMIBNotifs.4
| eval eventCategory=if(match(_raw,"ciscoLwappApMIBNotifs.4"),"Disassociated","Associated")
| rex "bsnAPName.0 = STRING: \"(?<apname1>\S+)\""
| rex "cLApName.'\S+' = STRING: (?<apname2>\S+)"
| eval apname = if(eventCategory=="Associated",apname2,apname1)
| eval timeAssoc =if(eventCategory=="Associated", _time,null())
| eval timeDisassoc =if(eventCategory=="Disassociated", _time,null())
| stats earliest(timeAssoc) as earliestTimeAssoc latest(timeAssoc) as latestTimeAssoc count(eval(eventCategory="Associated")) as AssocCount
earliest(timeDisassoc) as earliestTimeDisassoc latest(timeDisassoc) as latestTimeDisassoc count(eval(eventCategory="Disassociated")) as DisassocCount
 by apname
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I see two approaches, transaction and streamstats.

Taking query 1 as an example, you could filter for (association OR disassociation) events and walk the events by AP id with streamstats. On the way you have it number the events. Then you filter to get only the events with the lowest number - those that are disassociation events are APs that disassociated, but have not associated since.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...