7. Finding Data for the First Time in Splunk

If you have correctly completed the previous steps, data should be appearing and you should be able to locate it easily.

Searching

Note Set the Search bar presets to All time to locate data. If the Date/Time stamps are incorrect, you can adjust this in your NTP network firewall.

Try this search:

index=sonicwall

To get just your flow data:

index=sonicwall TemplateID=257

You should get something that looks like this:

TemplateID=257 session_id=2147521047 src_mac=00-50-56-A1-04-A0 dest_mac=00-00-00-00-00-00 src_ip=192.168.1.1 dest_ip=192.168.1.254 initiator_GW-IP_Addr=0.0.0.0 responder_GW-IP_Addr=0.0.0.0 src_int=19 src_port=51489 dest_port=443 init_to_resp_pkts=1 init_to_resp_octets=52 init_to_resp_delta_pkts=1 init_to_resp_delta_octets=52 start_time=2014-04-07 11:10:21 end_time=1969-12-31 16:00:00 tcp_flag=9 protocol=6 app_id=49178 user=5998591826582306817 virus_id=0

TemplateID=257 session_id=2147521046 src_mac=00-50-56-A1-04-A0 dest_mac=00-00-00-00-00-00 src_ip=192.168.1.1 dest_ip=192.168.1.254 initiator_GW-IP_Addr=0.0.0.0 responder_GW-IP_Addr=0.0.0.0 src_int=19 src_port=51488 dest_port=443 init_to_resp_pkts=6 init_to_resp_octets=834 init_to_resp_delta_pkts=6 init_to_resp_delta_octets=834 start_time=2014-04-07 11:10:21 end_time=1969-12-31 16:00:00 tcp_flag=9 protocol=6 app_id=49178 user=5998591826582306817 virus_id=0

TemplateID=257 session_id=2147521045 src_mac=00-50-56-A1-04-A0 dest_mac=00-00-00-00-00-00 src_ip=192.168.1.1 dest_ip=192.168.1.254 initiator_GW-IP_Addr=0.0.0.0 responder_GW-IP_Addr=0.0.0.0 src_int=19 src_port=51485 dest_port=443 init_to_resp_pkts=7 init_to_resp_octets=1500 init_to_resp_delta_pkts=7 init_to_resp_delta_octets=1500 start_time=2014-04-07 11:10:20 end_time=1969-12-31 16:00:00 tcp_flag=9 protocol=6 app_id=49178 user=5998591826582306817 virus_id=0

For more information on how to interpret the results, see NetFlow Conversion Template 257.

Table Quick Reference

Netflow Conversion