cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
debugger
Observer
Member since: ‎01-21-2011
‎07-14-2022
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎01-21-2011
Activity Feed
View All

Re: What are some search tips for network traffic ...

by in Splunk Enterprise
‎07-14-2022 09:03 AM
‎07-14-2022 09:03 AM
I would like to scan for activity within the prefixes like 192.168.1.0/24 but I'm not sure if cidrmatch is appropriate or how the syntax would work. ... View more

Re: What are some search tips for network traffic ...

by in Splunk Enterprise
‎07-14-2022 08:56 AM
‎07-14-2022 08:56 AM
sourcetype=dns:logs Does that help?  Right now I'm just running a verbose search like this: index=* 192.168.1.* or 192.168.2.* | stats county by src_ip, dest_ip service   There must be a better way to search for IP traffic. ... View more

Re: What are some search tips for network traffic ...

by in Splunk Enterprise
‎07-14-2022 06:50 AM
‎07-14-2022 06:50 AM
Do you mean datasets? I believe that this is syslog data from routers and firewalls.  Pardon my limited knowledge of splunk. ... View more

What are some search tips for network traffic hist...

by in Splunk Enterprise
‎07-13-2022 07:32 PM
‎07-13-2022 07:32 PM
Background story: We have some customers using a site to site VPN to reach our corporate networks.  The customer has like 3-4 network prefixes in their environment. I want to check network traffic counters to see if the customer networks are sending/receiving any traffic to/from my corporate network.  Please share some suggested searches.  I'm looking for ANY type of network traffic. For example: customer network A 192.168.1.0/24 customer network B 192.168.2.0/24 ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎07-14-2022 02:03 PM