Splunk Search

Sniffing Ports Up/Down -- IFconfig?

ddecker03
Loves-to-Learn Everything

Looking for a way to monitor sniffing ports on a sensor.  Each port is tied to a different part of the system and would like a dashboard notification UP/DOWN if traffic has not been rcvd say in 1-5 minutes.  

i thought about doing IFCONFIG, but I think I made it to complicated by using grep to narrow down just the RX/TX information.   

ifconfig | egrep -e ^eth | grep -v "inet\|UP"  which does a pretty good job for CLI output.   

I tried installing the App *Nix but cant really get it to work.  

I am using a Splunk server, and the "sensors" are a dffierant server which has the UFW.  

 

Thanks

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Consider putting your CLI command into a shell script and invoking the shell script as a Splunk scripted input every 5 minutes.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...