Cowboy Denny Posted August 2 Share Posted August 2 Here are some helpful queries I've used. GENERAL QUERIES Show all hosts in an index | tstats count where index=infra_network by index sourcetype host or | metadata type=hosts index=infra_network INFOBLOX QUERIES Find Audit Log Messages (which doesn't always work since not always is audit logs in Splunk) index=net_ops_prod_infoblox sourcetype="Infoblox:audit" Find Mac-Address index=net_ops_prod_infoblox "54:bf:64:a5:e0:82" Find DNS entries index=net_ops_prod_infoblox sourcetype="infoblox:dns" Find DHCP entries index=net_ops_prod_infoblox sourcetype="infoblox:dhcp" F5 QUERIES Another way of doing it index=infra_network host=* sourcetype=f5:bigip:syslog | stats count by host instance | stats list(count) list(instance) by host More coming Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.