topic Sub-Domain Count in Splunk Search

Sub-Domain Count

queme — Mon, 28 Sep 2020 12:00:53 GMT

I am looking to pull all domains from dns logs and get a count of how many unique sub-domains that were requested of that domain.

This is what I have so far. I might be going in the wrong direction so if I need to wipe and retry I ok with that.

index=dns | rex field=named_domain "(?([^.]+.)?[^.]+$)" | stats count by named_domain | uniq | table domain, count

My problem is that the count is not the count of the unique sub-domains but instead of I am getting all sub-domains grouped with the domain field.

Re: Sub-Domain Count

sowings — Tue, 03 Jul 2012 02:08:15 GMT

Your rex statement reads "look inside the field called 'named_domain' and capture <something DOT something>, and store the results in a field called 'domain'." Your stats call then sums over the original field named_domain; I suspect you're just dealing with a typo.

If I've missed the mark, maybe you could provide a couple samples lines (enough to spot a pattern) and the desired output?

Re: Sub-Domain Count

queme — Tue, 03 Jul 2012 02:32:13 GMT

Jul 3 02:19:31 query from IP: 1.1.1.1 Port#49335: Name: tap-cdn.rubiconproject.com. Destination: 2.2.2.2 Time: Jul 3 02:19:31

Jul 3 02:19:31 query from IP: 1.1.1.1 Port#65260: Name: api.echoenabled.com. Destination: 2.2.2.2 Time: Jul 3 02:19:31

Jul 3 02:20:56 query from IP: 1.1.1.1 Port#64937: Name: versatables-com.amazonwebstore.com. Destination: 2.2.2.2 Time: Jul 3 02:19:31

I changed the Ips for security reasons.

Re: Sub-Domain Count

queme — Tue, 03 Jul 2012 02:32:33 GMT

The name_domain field contains the entire domain (tap-cdn.rubiconproject.com) and my rex field will pull from that and show just rubiconproject.com. (I found this in one of the answers and it works well) My problem is if there are 100 logs with a request to tap-cdn.rubiconproject.com it will show a count of 100. only want to see 1. If there is another sub-domain tap1-cdn.rubiconproject and tap-cdn.rubiconproject I want it to show 2.

What I want it to look like:

Domain | # of Sub-Domains
Facebook.com 12
abc.com 2

Re: Sub-Domain Count

sowings — Mon, 28 Sep 2020 12:01:08 GMT

Perhaps stats distinct_count(name_domain) by domain is what you're looking for?

Re: Sub-Domain Count

queme — Tue, 03 Jul 2012 19:42:29 GMT

That worked great, thank you!