topic Re: Query to capture distinct source IP who triggered multiple signatures in Splunk Search

Query to capture distinct source IP who triggered multiple signatures

sumit29 — Wed, 23 Dec 2015 18:32:23 GMT

Dear Experts,

I require help to create the query.
I am creating the rule if single(unique) source triggered distinct signature(more than 2) . Than only we should get the result.

Fields involved src,signature,count

Thanks in advance

Re: Query to capture distinct source IP who triggered multiple signatures

dcarmack_splunk — Wed, 23 Dec 2015 21:27:27 GMT

index= sourcetype= | fields src signature | stats count by src signature | where count >= 2

Re: Query to capture distinct source IP who triggered multiple signatures

sumit29 — Wed, 23 Dec 2015 22:49:12 GMT

Thanks, But this query only gives signature count along with src , I require count of signature from single source.

Let say source 10.10.10.10 trigger signature name = x and another signature name =y . so this source triggered 2 distinct signature . This what i am looking

Re: Query to capture distinct source IP who triggered multiple signatures

dcarmack_splunk — Tue, 29 Sep 2020 08:16:57 GMT

Gotcha. Try this for your stats then.

... | stats values(signature) as signatures by src | eval sig_count=mvcount(signature) | where sig_count >= 2

Re: Query to capture distinct source IP who triggered multiple signatures

sumit29 — Wed, 23 Dec 2015 23:51:02 GMT

Thanks :)....

Re: Query to capture distinct source IP who triggered multiple signatures

dcarmack_splunk — Thu, 24 Dec 2015 01:00:14 GMT

no problem, glad to help!