Difference between revisions of "Splunk"
From neil.tappsville.com
Jump to navigationJump to searchm (→Search) |
m |
||
Line 23: | Line 23: | ||
host=<host_name> | table _raw | outputcsv rawdump.csv | host=<host_name> | table _raw | outputcsv rawdump.csv | ||
Then download as csv | Then download as csv | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
Line 42: | Line 34: | ||
</pre> | </pre> | ||
− | |||
== Transactions == | == Transactions == | ||
Line 62: | Line 53: | ||
=== IP lookup=== | === IP lookup=== | ||
+ | DNSlookup | ||
+ | |||
+ | |||
+ | The key for dnslookup is to put the data into a table before the lookup is called | ||
+ | host=*mgfw* DENY 192.168.0.1 | rex field=_raw "source-address=\"(?<sourceip>.*?)\" " | dedup sourceip | table sourceip | lookup dnslookup clientip AS sourceip | ||
+ | == RETURNS == | ||
+ | sourceip, clienthost | ||
+ | |||
+ | blah | lookup dnslookup clientip OUTPUT clienthost | ||
+ | |||
| lookup dnslookup clientip as source_ip_field OUTPUT clienthost as output_field | | lookup dnslookup clientip as source_ip_field OUTPUT clienthost as output_field | ||
+ | |||
+ | |||
===Comments=== | ===Comments=== |
Revision as of 04:42, 15 September 2022
Contents
Training
https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html
Search
Match Value (.*) after "want:" and turn it into a field (field_name)
| rex field=_raw "some text before what we want:(?<field_name>.*)"
Match field is NULL
NOT field=*
Visualizations
blah | timechart count by fieldname
Group results into 1 hour chunks
| timechart span=1h count(field_name) by field_name
Group by hour of day
| eval eventHour=strftime(_time,"%H") | stats count by eventHour
Export RAW logs
host=<host_name> | table _raw | outputcsv rawdump.csv
Then download as csv
Comments
host="*-blah" cmd=login NOT field=192.168.0.0/24 `comment("NOT xyz")` NOT field=192.168.10.0/24 `comment("NOT abc")` | fields field_one, device_ip, field_server | dedup field_one, device_ip, field_server
Transactions
eventtype=jbgp_state_change | transaction host,jbgp_state_instance,jbgp_state_peer startswith=(eventtype=jbgp_state_down) endswith=(eventtype=jbgp_state_up) keepevicted=true
Transforming Commands
| top [field field2] limit=0 showperc=False countfield="Renamed something" | Rate [field field2] limit=0
useother=True -- use when limit!=0 so 'extras' go into a catchall bucket
Stats - all stats functions must be done together (in the same pipes)
- Count
- Dc (Distinct Count)
- Sum -- stats sum(price) as "Gross Sales" by product_name
- Avg, Min, Max
- List -- stats list(Asset) as "stuff" by Employee
- Value - similar to list but unique.
IP lookup
DNSlookup
The key for dnslookup is to put the data into a table before the lookup is called
host=*mgfw* DENY 192.168.0.1 | rex field=_raw "source-address=\"(?<sourceip>.*?)\" " | dedup sourceip | table sourceip | lookup dnslookup clientip AS sourceip == RETURNS == sourceip, clienthost blah | lookup dnslookup clientip OUTPUT clienthost
| lookup dnslookup clientip as source_ip_field OUTPUT clienthost as output_field
Comments
Uses backticks
`comment("why did I add this random string to the search again?")`
Notify about Disabled Alerts
|REST /services/saved/searches | fields title disabled | where title like "IcareaboutX%" AND disabled=1
SNMP Link down
SNMP_TRAP_LINK* NOT"\.0" process=mib2d | table _raw