https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429904#M5573 <P>Ex: query=google.com , yahoo.com<BR /> src= xyz-pc , abc-pc</P> <P>I want to know the count of queries to each domain queried by an individual computer.</P> <P>For example, If I see a computer xyz-pc going to malicious sites multiple times everyday. I want to create a bin/bucket list to find, how many blocked queries and how many times the source computer has reached out to.</P> <P>Thanks.<BR /> Vish</P> Wed, 07 Aug 2019 06:36:28 GMT vishwanadhan_mu 2019-08-07T06:36:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429904#M5573 <P>Ex: query=google.com , yahoo.com<BR /> src= xyz-pc , abc-pc</P> <P>I want to know the count of queries to each domain queried by an individual computer.</P> <P>For example, If I see a computer xyz-pc going to malicious sites multiple times everyday. I want to create a bin/bucket list to find, how many blocked queries and how many times the source computer has reached out to.</P> <P>Thanks.<BR /> Vish</P> Wed, 07 Aug 2019 06:36:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429904#M5573 vishwanadhan_mu 2019-08-07T06:36:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429905#M5574 <P>Like this:</P> <PRE><CODE>... | stats count BY query src | sort 0 - count | stats list(*) AS * BY src | stats sum(count) AS TotalCount BY src | sort 0 - TotalCount </CODE></PRE> Wed, 07 Aug 2019 22:31:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429905#M5574 woodcock 2019-08-07T22:31:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429906#M5575 <P>Could you pleas explain me how it works, if possible.</P> <P>Especially the sort 0</P> Mon, 12 Aug 2019 03:59:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429906#M5575 vishwanadhan_mu 2019-08-12T03:59:18Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429907#M5576 <P>Does this work for you? The <CODE>0</CODE> on the sort makes it <CODE>unlimited</CODE> (the command has a stupid default that trims the result set). To see what it is doing, just add in each line one by one.</P> Tue, 13 Aug 2019 14:25:49 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429907#M5576 woodcock 2019-08-13T14:25:49Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429908#M5577 <P>IT worked. Thanks a lot</P> Wed, 14 Aug 2019 01:04:49 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429908#M5577 vishwanadhan_mu 2019-08-14T01:04:49Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429909#M5578 <P>OK, then you should come back and click <CODE>Accept</CODE> on the answer to close the question.</P> Wed, 14 Aug 2019 15:22:07 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Values-and-counts/m-p/429909#M5578 woodcock 2019-08-14T15:22:07Z