https://community.splunk.com/t5/Splunk-Search/Brute-Force-Query-Help/m-p/512178#M143629 <P>Hi</P><P>you should try eventstats instead of stats.&nbsp;<BR /><BR /></P><P>r. Ismo</P> Mon, 03 Aug 2020 16:30:23 GMT isoutamo 2020-08-03T16:30:23Z https://community.splunk.com/t5/Splunk-Search/Brute-Force-Query-Help/m-p/512170#M143628 <P>I am trying to mimic the table below. I have the count of the source IP, but how do I get the count of the respective subnets? In the example, they have it in the cell of each subnet value. Here is what I have so far:</P><P>&nbsp;</P><LI-CODE lang="markup">index=xxxx sourcetype=xxxx "xxxx" | eval ERROR_CODE=case((RC="200"), "Success", (RC="400"), "User Not Found",(RC="401") , "Bad Password",(RC="500"), "Internal Server Error") | rex field=_raw "TCIP='(?&lt;subnet_24&gt;\d+\.\d+\.\d+)\.\d+" | rex field=_raw "TCIP='(?&lt;subnet_16&gt;\d+\.\d+)\.\d+\.\d+" | eval subnet_24 = subnet_24 +".x" | eval subnet_16 = subnet_16 +".x.x" | stats count(TCIP) by subnet_24 subnet_16 TCIP</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alanzchan_0-1596468056771.png" style="width: 746px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9998i77A15001D4BF03F3/image-dimensions/746x356?v=v2" width="746" height="356" role="button" title="alanzchan_0-1596468056771.png" alt="alanzchan_0-1596468056771.png" /></span></P><P>Any help is appreciated!</P> Mon, 03 Aug 2020 15:26:49 GMT https://community.splunk.com/t5/Splunk-Search/Brute-Force-Query-Help/m-p/512170#M143628 alanzchan 2020-08-03T15:26:49Z https://community.splunk.com/t5/Splunk-Search/Brute-Force-Query-Help/m-p/512178#M143629 <P>Hi</P><P>you should try eventstats instead of stats.&nbsp;<BR /><BR /></P><P>r. Ismo</P> Mon, 03 Aug 2020 16:30:23 GMT https://community.splunk.com/t5/Splunk-Search/Brute-Force-Query-Help/m-p/512178#M143629 isoutamo 2020-08-03T16:30:23Z