What I need is mark ip addresses or events in a first search to use it later. I gave two example of filters:
filter all ip addresses that tried to access administration.
filter all ip addresses that belong to country C.
So further in my analysis I will use this 2 ip addresses.
I have 2 options tag clientip or create an eventtype.
The first one seem more logic, because I'm marking only one field: clientip. But, the limitation here I can't tag'em all automatically. I should tag each ip address manually, but I have a couple hundreds of em coming from country X and another couple hundreds that tried to access to my administration page.
So the second one should be good, if I use subsearch. Again, there is a limitation, Eventtype search string cannot be a search pipeline or contain a subsearch. This limitation may be exists because of some theoretical or practical problems that may occur otherwise.
while I was looking for an answer I found this question about search some specific bad domains:
http://answers.splunk.com/answers/2457/inputlookup-against-a-list-of-bad-domains
The difference between this case and mine, is that i should create my bad guys ip list from my data in Splunk not from an other source. But, why not export my list of suspects?
so I export it the first and second list to two csv files:
host=apache | iplocation clientip | search Country=X | fields clientip | dedup clientip | outputlookup suspectIP1.csv
host=apache uri="/admin/*" | dedup clientip | fields clientip | outputlookup suspectIP2.csv
Then I used with both lists, and ofcourse I can call this two lists any time later:
host=habous [|inputlookup suspectIP2.csv | fields clientip] [|inputlookup suspectIP1.csv| fields clientip]
Now I have only 4 IP addresses instead of hundreds. Honestly, I wanted something less complicated like:
host=apache tag=suspectIP1 tag=suspectIP2
As for the second question, this is the answer that I found:
host=apache | eval OK=if(status==200,1.0,0.0) | stats sum(OK) as sum,count by clientip | eval avg=(1-sum/count) | fields clientip avg| sort - avg | head 20
But, I don't know how add a new column or save it permanently (except exporting it in a csv format)
... View more
