topic Re: group ip by count in Splunk Search

group ip by count

janfabo — Thu, 06 Sep 2012 20:45:42 GMT

Hello, I'm trying to write search, that will show me denied ip's sorted by it's count, like this:
host="1.1.1.1" denied | stats sum(count) as count by src_ip | graph, but this only shows me number of matching events and no stats. I'd like to visualize result in form of either table or chart. Could you please advise me how to do that? Thanx in advance.

Re: group ip by count

janfabo — Thu, 06 Sep 2012 21:00:04 GMT

well I did it through CLI: # ./splunk search "host=\"20.20.20.5\" denied" | awk '{ print $14 }' | sort | uniq -c , but how to do it through webinterface?

Re: group ip by count

jonuwz — Thu, 06 Sep 2012 21:59:52 GMT

Something like this :

host="20.20.20.5" denied | chart count by src_ip

Re: group ip by count

janfabo — Fri, 07 Sep 2012 06:24:21 GMT

well, this shows 0 results even if there are 10 matching events (1). See the picture here. When I click 2 at the picture there is 10 log records. Maybe I have something misconfigured...

Re: group ip by count

jonuwz — Fri, 07 Sep 2012 06:34:12 GMT

Can you post a sample of the data?

Re: group ip by count

gkanapathy — Fri, 07 Sep 2012 06:46:39 GMT

First of all, src_ip must actually be a field that exists in the data and is extracted by Splunk.

If it is, then

... "denied" | top src_ip

... "denied" | stats count by src_ip | sort - count

Re: group ip by count

janfabo — Sat, 08 Sep 2012 05:52:17 GMT

Great, it works! The field didn't exists, after adding extraction rule everything works. thanks.