Hi I'm new to Splunk and am having a hard time finding a simple solution to this.
I tried using subsearch and append but couldn't do it. Wherever I look, it only has complicated solutions with at least 5 pipes.
How do I create an alert if two certain events occurred and their ip addresses match? (Source OR Destination ip whichever)
1. index=snort sid=100 src_ip=192.168.1.3 dst_ip=192.168.1.5
2. index=snort sid=101 src_ip=192.168.1.5 dst_ip=192.168.1.3
If its possible to check whether if event #2 occurred within 5 minutes of event #1 at the same time, that would be great.
I am not sure what extracts you have setup but you could use a transaction: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Transaction
| transaction src_ip maxspan=5m
Need some more information to get things exact but it seems using transaction should work. If you can provide some more information that would help.
HI jinito14002,
try something like this:
index=snort
| eval ip=src_ip.",".dst_ip
| makemv ip delim=","
| mvexpand ip
| stats count BY ip
| where count>1
Bye.
Giuseppe
I am not sure what extracts you have setup but you could use a transaction: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Transaction
| transaction src_ip maxspan=5m
Need some more information to get things exact but it seems using transaction should work. If you can provide some more information that would help.
Thanks, this did the trick for me. just needed that one word "transaction"