Ad slot: top
GoSplunk SPL + dashboard repository
Log in Register

SPL

Netflow search that works with Splunk Network Graph visualization in Dashboard Studio Builder

Netflow lookup
1 0

Description

Submitted by thall

Built this search to see if I could create a topology using Network Graph visualization in Splunk. You can find a video I created to cover this topic here: https://youtu.be/FIoy-OU7_XM You will need to replace the index value and lookup tables that are wrapped in <> with your own values. Also with the Network Graph visualization, once you create the lookup sheet there is way to assign roles to take advantage of Icons or grouping. That will probably be project another time. 
index=<netflow>
| fields src_ip dest_ip bytes packets
| lookup <dhcp_leases.csv> ip as src_ip OUTPUT hostname as src_host
| lookup <dhcp_leases.csv> ip as dest_ip OUTPUT hostname as dest_host
| eval source = if(cidrmatch("192.168.0.0/16",src_ip) OR cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip),
                   if(isnotnull(src_host), src_host, src_ip), "Internet")
| eval target = if(cidrmatch("192.168.0.0/16",dest_ip) OR cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip),
                   if(isnotnull(dest_host), dest_host, dest_ip), "Internet")
| stats sum(bytes) as bytes sum(packets) as packets count as flows by source target dest_ip src_ip
| eval linkValues=round(bytes/1024/1024,2), linkTexts=linkValues." MB"
| sort - linkValues
| table source target linkValues linkTexts flows packets dest_ip src_ip

Comments

0 total

Be the first to comment on this SPL.

Leave a comment

You must log in to post a comment.

Ad slot: bottom