| table src dest bytes_out total_bytes_out | eventstats sum(bytes_out) AS total_bytes_out by src That output can then be treated as a field value that can be outputted with additional Splunk commands. Eventstats is calculating the sum of the bytes_out and renaming it total_bytes_out grouped by source IP address.
Using the same basic search criteria as the earlier search, we slightly augmented it to make sure any bytes_out are not zero to keep the result set cleaner. I like to think of eventstats as a method to calculate “grand totals” within a result set that can then be used to further manipulate these totals to introspect the data set further.Īnother hypothesis I might want to pursue is identifying and investigating the systems with the largest byte counts leaving the network but to effectively hunt, I want to know all of the external hosts that my system is connecting to and how much data is going to each host. With these fundamentals in place, let’s apply these concepts to eventstats. The point is there are numerous ways to leverage stats. As a side note, if I saw the result set above I might ask why I am seeing many hosts from the same subnet all communicating to the same destination IP, with identical byte counts, both in and out. By changing the sort, I can easily pivot to look at the top inbound byte volumes or even the low talkers based on lowest byte count (which might be its own hypothesis). In this example, the same data sets are used but this time, the stats command is used to sum the bytes_in and bytes_out fields. | table src dest total_bytes_in total_bytes_out | stats sum(bytes_in) as total_bytes_in sum(bytes_out) as total_bytes_out by src dest Using the stats command, multiple fields can be calculated, renamed and grouped. A hypothesis might be to look at firewall traffic to understand who my top talkers to external hosts are, not from a connection perspective, but from a byte perspective. Once the count is generated, that output can be manipulated to get rid of single events and then sorted from largest to smallest.Īnother use for stats is to sum values together. The stats command is generating a count, grouped by source and destination address. The search is looking at the firewall data originating from the 192.168.225.0/24 netblock and going to destinations that are not internal or DNS. I might hypothesize that the source destination pairs with the largest amount of connections starting in a specific netblock are of interest to dig deeper into.
#SPLUNK STATS ROUND HOW TO#
Here is a good basic example of how to apply the stats command during hunting. Using the keyword by within the stats command can group the statistical calculation based on the field or fields listed. It will perform any number of statistical functions on a field, which could be as simple as a count or average, or something more advanced like a percentile or standard deviation. The stats command is a fundamental Splunk command. Like many Splunk commands, all three are transformational commands, meaning they take a result set and perform functions on the data. When I say stats, I am not just referring to the stats command there are two additional commands that are worth mentioning-eventstats and streamstats. When focusing on data sets of interest, it's very easy to use the stats command to perform calculations on any of the returned field values to derive additional information. I won’t belabor the point, but it's such a crucial capability in the context of threat hunting that it would be crime to not talk about it in this series.
If you have spent any time searching in Splunk, you have likely done at least one search using the stats command. This is part six of the " Hunting with Splunk: The Basics" series.
0 kommentar(er)
