topic Re: Top command based on lookup result in Splunk Search

Top command based on lookup result

bugnet — Thu, 27 Jul 2017 14:34:24 GMT

The following search will give the count of attacks by attacker_IP and destination branch.

index=waf   Name=block | lookup Branches IP AS dest OUTPUTNEW branch | stats count by src branch | sort -count

Now I just want to show the top 10 attacker IPs per Branch based on their high count.

Help is always appreciated.

Thanks!!

richgalloway — Thu, 27 Jul 2017 15:24:22 GMT

I think the top command will do that. Try this

index=waf   Name=block | lookup Branches IP AS dest OUTPUTNEW branch | stats count by src branch | sort -count | top limit=10 count by branch

bugnet — Mon, 31 Jul 2017 08:25:47 GMT

Not working for me.

HiroshiSatoh — Mon, 31 Jul 2017 08:48:23 GMT

try this!

 index=waf   Name=block | lookup Branches IP AS dest OUTPUTNEW branch | stats count by src branch | sort branch .- count|dedup 10 branch