Let’s say I have determined that this IP address is from a nefarious entity and that I want to be alerted immediately if there are failed logins from this IP address. But Splunk makes it even easier – I simply mouse over and select the IP address (Splunk will highlight it in yellow), then I left-click and select “Add to search.” Voila! The search updates and I get just the events that represent failed logins from that single source IP address. I could modify the search to tell me exactly how many failed attempts are from this IP address. (I cheated and consulted the Cisco syslog message format reference documentation and will tell you that this represents the source IP address and TCP/UDP port number of the failed login attempt.) In the screenshot you can also see that two of the first three results are from the same IP address. In the screenshot above (click the image to enlarge), you can see that there is a piece of data in each matching event called “Source” followed by what appears to be an IP address and a port number. It displays the total number of events that matched the search term, it provides the syslog message timestamp, and highlights the individual search terms in each event that matched the search. Splunk works its magic and immediately returns all of the event messages (from the device syslog message data source) that match the search terms. I’ll start with a wild guess and try to find all login failures using the keywords “login” and “failed” or “failure”? Entering login fail* into the search bar will return all events that contain the word “login” and any word containing the stub “fail”. This is where the most basic of Splunk capabilities shines: searching data sources for specific terms and text patterns.ĭo you know the specific format of a Cisco IOS log message for a failed login attempt? That makes two of us. For a multitude of reasons, that’s generally not the case. If you’re fortunate (I mean really lucky), the logs are well formatted and use a human-friendly, readable format. Oh the Wonderful Things Splunk Can Do: Searching, Alerts, Dashboards (and so much more)Īs a system, network, or security administrator, you’ve likely had to review log files from various systems, devices and applications. So what now? Well, let’s see how we go about looking into what we’ve got via Splunk’s built-in Search & Reporting App. For testing purposes, Micah discussed creating a syslog listener on your Splunk server that would allow the events to be indexed as they are generated. These activities are recorded in the switch/router syslog messages. We will build on the use case and data sources Micah identified in his post: tracking failed logins to Cisco switches and routers. The whole thing can be completed in a couple hours and will show you how quickly you can start getting value from data you already have access to today.Īt this point I’ll assume you’ve got a working Splunk installation and understand the basics of getting data into Splunk. If you’re just getting your feet wet with Splunk, or are looking to do so, I highly recommend the Splunk Search Tutorial that takes you from installation through creating reports and charts in a building block approach. In this post, I will pick up where Micah left off and talk about some of the ways you can very quickly get insight out of your data. After all, without data, your Splunk instance will get bored and lonely.

He outlined a basic process and framework to follow when you need to successfully get data into Splunk so that you can make that data meaningful, actionable and useable. In the last post on this topic, my fellow Splunk architect, Micah Montgomery, gave an overview of one of the most important parts of getting going with Splunk: Getting Data In.

Splunk login