How to search use stats count filter two fields?

longmen — Fri, 28 Apr 2023 13:41:38 GMT

Hi All,

I am doing a search for src_ip and DestAdd in a database within a 1 minute time frame. I need to look for src_ip which value that is not greater than 1 and DestAdd that is not greater than 5. Here is the description of the problem: when any of these with the same source IP more than 1 time, across more than 5 destination IP within 1 minutes. I wonder if my query correct. Can anyone advise? Thanks

|bin span=1m _time |stats count(src_ip) as src_ip, count(DestAddress) as DestAddress by _time |where (src_ip > 1 and DestAddress>5)

Re: How to Search Use Stats Count Filter Two Fields

yuanliu — Fri, 28 Apr 2023 06:04:26 GMT

One thing is not completely clear in your description. Any src_ip that makes contact with "more than 5 destination IP within 1 minutes" must have appeared "more than 1 time" during the same minute. Is there some additional constraint?

If there is no additional condition, you can use this search

| bin span=1m _time | stats dc(DestAddress) as unique_dest by src_ip _time | where unique_dest > 5

This is assuming that src_ip and DestAddress are present in the same event. The question doesn't seem to make sense if an event only contains src_ip or DestAddress but not both, unless there is some other way to link src_ip and DestAddress. If that is the case, you will need to analyze that link.

topic Re: How to Search Use Stats Count Filter Two Fields in Splunk Search

How to search use stats count filter two fields?

Re: How to Search Use Stats Count Filter Two Fields