https://community.splunk.com/t5/Security/Search-Unique-Source-IPs-Associated-with-10-Unique-Destination/m-p/510853#M11656 <P>Try this.</P><LI-CODE lang="markup">index="indexabc" dest_port=0 | stats count, dc(dest_ip) as UniqueDestinations by src_ip | where UniqueDestinations &gt;= 10</LI-CODE> Fri, 24 Jul 2020 14:56:13 GMT richgalloway 2020-07-24T14:56:13Z https://community.splunk.com/t5/Security/Search-Unique-Source-IPs-Associated-with-10-Unique-Destination/m-p/510845#M11655 <P>Hi all I’m new to Splunk so forgive my ignorance.&nbsp; We’re currently using Splunk as a SIEM and I’m having trouble getting a search query put together.</P><P>What I’m looking for is:</P><P>Show me all unique sources that have initiated ICMP traffic.&nbsp; I believe that I’m getting the correct results with the following search string.</P><P>index="indexabc" dest_port=0 | stats count by src_ip</P><P>The additional information I’m looking for is “by unique source IP (above) find those that have 10+ unique destination IPs (dest_ip).”</P> Fri, 24 Jul 2020 14:23:41 GMT https://community.splunk.com/t5/Security/Search-Unique-Source-IPs-Associated-with-10-Unique-Destination/m-p/510845#M11655 ltcsecurity 2020-07-24T14:23:41Z https://community.splunk.com/t5/Security/Search-Unique-Source-IPs-Associated-with-10-Unique-Destination/m-p/510853#M11656 <P>Try this.</P><LI-CODE lang="markup">index="indexabc" dest_port=0 | stats count, dc(dest_ip) as UniqueDestinations by src_ip | where UniqueDestinations &gt;= 10</LI-CODE> Fri, 24 Jul 2020 14:56:13 GMT https://community.splunk.com/t5/Security/Search-Unique-Source-IPs-Associated-with-10-Unique-Destination/m-p/510853#M11656 richgalloway 2020-07-24T14:56:13Z