ELK vs Splunk

[akash.01 (Akash V)]

I am very new to ELK. In my organization We are thinking of migrating from Splunk Enterprise to ELK. But before doing that I was asked to test whether we are able to run all the use cases we have built on Splunk in ELK. I have completed till indexing the data. Now the problem is with querying. In splunk lets say I use a simple query "index=bluecoat category="Phishing"|table user source_ip". This would create a table with the user with source_ip who have visited sites categorized as phishing. Can someone help me whether this can be done using Kibana or any other app? Is it even possible to do so. Any help at the earliest would be appreciated.

[shaktigupta200 (Shakti Gupta)]

Kibana is a great tool to be work with. My organization is using ELK and it provides all the logging solution.

[akash.01 (Akash V)]

Sorry, but does that answer my question?

[stiltz]

You can certainly do this...
I would run a search in Discover with the following parameters:

1. Select your BlueCoat index
2. Your query would look something like this: category:Phishing
3. Save your query
4. Create a new visualization by going to the Visualize tab
5. Create a new Data table visualization from the search you just saved
6. Add a metric, split rows, with the term for source IP. You'll get a count by source IP. like this:
   
   
   and you'll end up with something like this:

You can add more buckets to get more granular or flip it to destination hostname/ip, whatever you want.