topic detect repeating values over time in Reporting

detect repeating values over time

stephen123 — Fri, 05 Apr 2013 08:29:48 GMT

Hi - I want to detect IP's which continually appear in the logs over a 24 hour period
They must appear at least once every hour over the 24 hours to be included in the results.

Thanks

Re: detect repeating values over time

kristian_kolb — Fri, 05 Apr 2013 08:57:43 GMT

Assuming that you have the IP address in a field called ip, this is one of the ways to achieve this.

sourcetype=blah earliest=-1d | stats dc(date_hour) as hrs by ip | search hrs=24

Hope this helps,

Kristian

Re: detect repeating values over time

stephen123 — Thu, 11 Apr 2013 16:01:36 GMT

thanks - works perfect

Re: detect repeating values over time

stephen123 — Thu, 11 Apr 2013 16:01:53 GMT

Thanks - works perfect

Re: detect repeating values over time

jtrucks — Thu, 11 Apr 2013 16:37:03 GMT

Mark it as correctly answered!