topic Re: How do I count by a field and then use that count to sort by in a table? in Splunk Search

How do I count by a field and then use that count to sort by in a table?

digital_alchemy — Fri, 22 Mar 2013 15:46:22 GMT

I'm new to Splunk we just started using it recently so please forgive the newbie question.

Current search:

sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode" | table severity signature src src_port dest dest_port

Results in:

severity     signature     src     src_port     dest     dest_port

I want to modify the search to provide a summary of the number of events comming from each src IP to the dest IP and be able to sort by that count.

Desired:

severity     signature     src     dest     dest_port     count

I've tried a few different searches such as this one:

sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode" | stats count by src | sort -num(count) | table severity signature src dest dest_port count

However this only populates the src and count column. I'm not quite sure what I'm missing.

Re: How do I count by a field and then use that count to sort by in a table?

krugger — Mon, 28 Sep 2020 13:35:04 GMT

I would say this is the most direct way of implementing what you are looking for:

sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode" | top severity,signature,src,src_port,dest,dest_port limit=50

Re: How do I count by a field and then use that count to sort by in a table?

kristian_kolb — Fri, 22 Mar 2013 15:53:49 GMT

This works?

 your search |  stats count by severity src dest dest_port signature

Re: How do I count by a field and then use that count to sort by in a table?

yannK — Fri, 22 Mar 2013 15:55:48 GMT

If you use a stats, only the fields and results that are in the stats will exists after.

the basic search will be
sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode" | stats count by severity signature src dest dest_port | sort -num(count)

and if you just want the count per src and dest, you can group the others fields in a multiline result

sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode" | stats count values(severity) AS list_severity values(signature) AS list_signature values(dest_port) AS list_dest_port by src dest | sort -num(count)

Re: How do I count by a field and then use that count to sort by in a table?

digital_alchemy — Fri, 22 Mar 2013 15:57:59 GMT

Works perfectly... thanks for such a quick reply. I didn't even think of the top command I was stuck on using count and sort.

Thanks again.