topic Re: Excluding daily values in chart if less then 1 in Splunk Search

Excluding daily values in chart if less then 1

fatsug — Thu, 21 Jul 2022 08:08:44 GMT

Hello community

I am trying to combine two different things and cannot figure out how. I am looking at a certain action and counting how many times this is observed per IP address and day. Then I’m plotting per IP by day to try to find recurring events based on IP address. I got this far:

<base-search> earliest="-7d@d" latest="@d"
| chart count over ip by date_wday

Which does exactly what is intended, tough the details are lost as there are a lot if single events per IP address. So, I’d like to filter out any IP address with only 1 event during the period (here one week).

This works fine for filtering:

| stats count as sum by ip
| search summa > 1

But then I loose the details needed for the chart part. I figured maybe I could use eval to filter out based on total count but could not put together anything which worked. Even when I tried to combine stats and eval I either failed or ended up with something which could not be presented graphically.

Any suggestions are more than appreciated

Best regards

// G

Re: Excluding daily values in chart if less then 1

javiergn — Thu, 21 Jul 2022 08:15:03 GMT

Hi,

Perhaps you can do it with timechart and a where clause. Something like:

<base-search> earliest="-7d@d" latest="@d" | timechart span=1d count as sum by ip where sum > 1

Re: Excluding daily values in chart if less then 1

JacekF — Thu, 21 Jul 2022 08:17:26 GMT

You can try:

| eventstats count by IP
| where count > 1

Re: Excluding daily values in chart if less then 1

fatsug — Thu, 21 Jul 2022 08:23:58 GMT

This was exactly what I was looking for, thank you very much!

// G

Re: Excluding daily values in chart if less then 1

fatsug — Thu, 21 Jul 2022 08:28:24 GMT

I could and your suggestions works so a big thank you! However, this gives number of hits per IP by day, I wanted to see number of hits per day by IP.

I started out with timechart though as I wanted a bargraph showing if any IP performed the same action on any two or more days in the past week. I guess you could "switch" the x-axis for timechart (?) though it just seemed more appropriate to use chart.

Again, thank you very much! I'll hang an to that combination for later use!

Best regards

// G