topic Re: Calculate how many IPs changed since last week in Splunk Search

Calculate how many IPs changed since last week

Regengott — Fri, 12 Jul 2013 12:49:51 GMT

I have a bunch of log files from a honeypot. In this logfiles, I have IP-Adresses which appear almost every day and some of them change. Now I'd like to see on a per week basis how many new IPs dropping in the pot.

Just to make my analysis problem clear

IPs in week 1

1.2.3.4

2.3.4.5

3.4.5.6

IPs in week 2

1.2.3.4

2.3.4.5

3.4.5.6

9.9.9.9

The result would be "1 IP added since last week"

Re: Calculate how many IPs changed since last week

linu1988 — Fri, 12 Jul 2013 12:59:53 GMT

use join to see the difference

Re: Calculate how many IPs changed since last week

bmunson_splunk — Fri, 12 Jul 2013 13:17:20 GMT

You need to do a subsearch and use the boolean NOT to exclude those results.

source=mylogs src_ip=* NOT [ search earliest=-14d@d latest=-7d@d  source=mylogs | stats count by src_ip | fields src_ip ] | stats dc(src_ip) as "New IP's this week"

If you are regularly doing this and have a lot of data, you might want to schedule the subsearch to speed this up.

edited to add the command "search" above and modify output

Re: Calculate how many IPs changed since last week

Regengott — Fri, 12 Jul 2013 13:25:23 GMT

Thx for quick response, but unfortunately I got an error "Unknown search command 'earliest'". Perhaps I should have mentioned I used the free version 5.0.3?

Re: Calculate how many IPs changed since last week

okrabbe_splunk — Fri, 12 Jul 2013 13:39:59 GMT

he just forgot to put the search command. Add the word search before earliest. ie:
source=mylogs src_ip=* NOT [ search earliest=-14d@d latest=-7d@d .....

Re: Calculate how many IPs changed since last week

Regengott — Fri, 12 Jul 2013 14:17:40 GMT

/me = newbie 🙂 Thx - now I got a result, I need to interpret it, wether it is what I want