topic Re: stats,streamstats command question in Splunk Search

stats,streamstats command question

nnonm111 — Thu, 26 Aug 2021 00:59:09 GMT

I'm going to check the permission and rejection of the scan attack per hour.
At this point, what I wrote...
Which is appropriate, Vlaues or the list? Also, which one is suitable, stats or stream stats?

index="firewall" (action="allow" OR action="deny" ) AND ( attack="*scan")
| bin _time span=1d
| stats count by _time,src_ip,dest_ip,app
| stats values(dest_ip) AS dest_ip , values(count) AS count by _time,src_ip,app
| table _time, src_ip ,app, dest_ip , count

Re: stats,streamstats command question

venkatasri — Thu, 26 Aug 2021 01:39:43 GMT

@nnonm111 stats should work for your case changed span to 1h.

Re: stats,streamstats command question

venkatasri — Thu, 26 Aug 2021 01:42:19 GMT

instead of values(count) in second stats try sum(count)

Re: stats,streamstats command question

nnonm111 — Thu, 26 Aug 2021 01:57:02 GMT

thankyou

I understand the difference between value and list is deduplication, which value will be removed?
Also, if you do list(app) and by app, the values are different.
What's the reason?

Re: stats,streamstats command question

venkatasri — Thu, 26 Aug 2021 02:03:43 GMT

I have updated SPL, list() is an aggregation function it doesn't care of duplicates and by is clause for grouping.

Re: stats,streamstats command question

nnonm111 — Thu, 26 Aug 2021 02:15:42 GMT

index="firewall" (action="allow" OR action="deny" ) AND ( attack="*scan")
| bin _time span=1h
| stats count by _time,src_ip,dest_ip,app
| stats values(dest_ip) AS dest_ip , sum(count) AS count by _time,src_ip,app
| table _time, src_ip ,app, dest_ip , count

index="firewall" (action="allow" OR action="deny" ) AND ( attack="*scan")
| bin _time span=1h
| stats count by _time,src_ip,dest_ip,app
| stats values(dest_ip) AS dest_ip , sum(count) AS count values(app) AS app by _time,src_ip
| table _time, src_ip ,app, dest_ip , count

What's the difference if the app changes?