https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20505#M3209 <P>In the end, I ended us using these:</P> <P>sourcetype="access_combined_wcookie" OR sourcetype="access_combined" | stats count by clientip, method | stats count by clientip | sort -count</P> <P>and this</P> <P>sourcetype="access_combined_wcookie" OR sourcetype="access_combined" | stats count by clientip, status | stats count by clientip | sort -count</P> <P>with GREAT results that led me to some fun web mayhem that was happening.</P> <P>Thanks a lot to all involved <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 28 Sep 2020 09:38:17 GMT anton_chuvakin 2020-09-28T09:38:17Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20496#M3200 <P>It seems simple but somehow the answer escapes me. I have Apache http access logs and I want to look for source IPs that produced the highest number of HTTP response codes, methods, etc.</P> <P>E.g. 10.10.10.10 only used GET, while 11.11.11.11 used GET, POST, PUT, etc on my webserver. You can see where I am going with this.</P> <P>So, what kinda query would do it?</P> Wed, 01 Jun 2011 00:11:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20496#M3200 anton_chuvakin 2011-06-01T00:11:50Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20497#M3201 <P>This (<A href="http://splunk-base.splunk.com/answers/6015/display-field-uniques-in-search">http://splunk-base.splunk.com/answers/6015/display-field-uniques-in-search</A>) seems related but isn't quite the same since I need to rank by uniqueness...</P> Wed, 01 Jun 2011 00:13:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20497#M3201 anton_chuvakin 2011-06-01T00:13:31Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20498#M3202 <P>Here are two examples of what you asked for --</P> <P>Most number of methods used, not counting duplicates</P> <PRE><CODE>sourcetype="access_combined" | dedup clientip, method | top clientip </CODE></PRE> <P>Most number of unique pages visited</P> <PRE><CODE>sourcetype="access_combined" | dedup clientip, uri | top clientip </CODE></PRE> <P>But here are variations that might be more useful --</P> <PRE><CODE>sourcetype="access_combined" | stats count by clientip, method | sort -count sourcetype="access_combined" | stats count by clientip, uri | sort -count </CODE></PRE> <P>Finally, take it to the next level by clicking the "Build Report" button and making a graph or chart of the results!</P> Wed, 01 Jun 2011 00:35:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20498#M3202 lguinn2 2011-06-01T00:35:33Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20499#M3203 <P>In addition to what lguinn posted, this </P> <PRE><CODE>sourcetype="access_combined" | stats distinct_count(method) as dcm by clientip | sort -dcm </CODE></PRE> <P>is fairly explicit.</P> Wed, 01 Jun 2011 02:44:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20499#M3203 gkanapathy 2011-06-01T02:44:46Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20500#M3204 <P>To really figure out what he asked, the last couple should actually look like: <CODE>sourcetype="access_combined" | stats count by clientip, method | stats count by clientip | sort -count</CODE></P> Wed, 01 Jun 2011 02:45:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20500#M3204 gkanapathy 2011-06-01T02:45:58Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20501#M3205 <P>Ah, that's a more efficient solution.</P> Wed, 01 Jun 2011 17:16:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20501#M3205 lguinn2 2011-06-01T17:16:58Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20502#M3206 <P>Well, probably not more efficient, but more clearly corresponding to what you're asking for.</P> Wed, 01 Jun 2011 17:32:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20502#M3206 gkanapathy 2011-06-01T17:32:22Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20503#M3207 <P>Thanks a lot for this!!</P> Wed, 01 Jun 2011 22:56:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20503#M3207 anton_chuvakin 2011-06-01T22:56:43Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20504#M3208 <P>Thanks a lot for this as well!!</P> Wed, 01 Jun 2011 22:56:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20504#M3208 anton_chuvakin 2011-06-01T22:56:52Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20505#M3209 <P>In the end, I ended us using these:</P> <P>sourcetype="access_combined_wcookie" OR sourcetype="access_combined" | stats count by clientip, method | stats count by clientip | sort -count</P> <P>and this</P> <P>sourcetype="access_combined_wcookie" OR sourcetype="access_combined" | stats count by clientip, status | stats count by clientip | sort -count</P> <P>with GREAT results that led me to some fun web mayhem that was happening.</P> <P>Thanks a lot to all involved <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 28 Sep 2020 09:38:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-sources-IPs-with-the-highest-number-of/m-p/20505#M3209 anton_chuvakin 2020-09-28T09:38:17Z