topic How to get count of each source by IP ? in Splunk Search

How to get count of each source by IP ?

Vani_26 — Tue, 31 Jan 2023 21:01:24 GMT

Query:
|tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer)

i want to get the count of each source by host_ip as shown below.
output:

source	11.56.67.12	11.56.67.15	11.56.67.18	11.56.67.19
/app/clts/shift.logs	987	67	67	89
/apps/lts/server.logs	45	45	67	43
/app/mts/catlog.logs	89	89	65	56
/var/http/show.logs	12	87	43	65

Re: How to get count of each source by IP ?

richgalloway — Tue, 31 Jan 2023 21:05:01 GMT

What does the current query give you? Is the offer field indexed?

Have you tried grouping by host_ip?

|tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) by host_ip

Re: How to get count of each source by IP ?

Vani_26 — Tue, 31 Jan 2023 21:54:36 GMT

hi @richgalloway

1. What does the current query give you? Is the offer field indexed?

No offrer field is not an index field.

2. When i tried to use the below query i am getting the output as:

|tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) by host_ip

host_ip	count
11.56.67.12	45
11.56.67.14	56

But i am not expecting this output.

Re: How to get count of each source by IP ?

richgalloway — Wed, 01 Feb 2023 21:08:59 GMT

I should have included source in the by clause. Then you can use the xyseries command to rearrange the table.

|tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) by source, host_ip | xyseries source host_ip count

Re: How to get count of each source by IP ?

Vani_26 — Wed, 01 Feb 2023 23:22:59 GMT

Thank you @richgalloway it worked