https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160523#M45371 <P>this puts it all into one list i need them in 2 lists one list for src and one list for dest </P> Wed, 29 Apr 2015 00:17:00 GMT tve784 2015-04-29T00:17:00Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160507#M45355 <P>I'm trying to get my current 2 searches into 1. I am trying to get a list of all source and destination ip's based on the same destination port. I have it in 2 searches by doing this on the end of my search:</P> <PRE><CODE>| stats count by src_ip </CODE></PRE> <P>second search</P> <PRE><CODE>| stats count by dest_ip </CODE></PRE> <P>basically i just need a list of all source ip's and a list of all dest ip's that have the same dest port</P> <P>any tips or help would be greatly appreciated </P> Tue, 28 Apr 2015 22:57:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160507#M45355 tve784 2015-04-28T22:57:24Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160508#M45356 <P>try this</P> <P>|transaction dest_port|table dest_port, src_ip, dest_ip</P> Mon, 28 Sep 2020 19:42:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160508#M45356 kml_uvce 2020-09-28T19:42:28Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160509#M45357 <P>Hello.<BR /> try this:</P> <PRE><CODE>index=... soucetype=... dest_port=*| stats count by src_ip| stats count by dest_ip| table src_ip dest_ip dest_port </CODE></PRE> Tue, 28 Apr 2015 23:11:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160509#M45357 NOUMSSI 2015-04-28T23:11:46Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160510#M45358 <P>that's still grouping them together somehow. Its making multiple rows with not all the same results in each row</P> Tue, 28 Apr 2015 23:13:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160510#M45358 tve784 2015-04-28T23:13:46Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160511#M45359 <P>this give 0 results</P> Tue, 28 Apr 2015 23:21:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160511#M45359 tve784 2015-04-28T23:21:14Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160512#M45360 <P>... dest_port=*| table src_ip dest_ip dest_port</P> Mon, 28 Sep 2020 19:38:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160512#M45360 NOUMSSI 2020-09-28T19:38:43Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160513#M45361 <P>i didnt think you can do 2 stats commands like that in a row because the second one wouldnt have any results because there is no dest ip to count by from the first stats command</P> Tue, 28 Apr 2015 23:24:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160513#M45361 tve784 2015-04-28T23:24:45Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160514#M45362 <P>yeah i tried that already it shows each src and dest ip paired together </P> Tue, 28 Apr 2015 23:26:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160514#M45362 tve784 2015-04-28T23:26:26Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160515#M45363 <P>what do you want now?</P> Tue, 28 Apr 2015 23:28:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160515#M45363 NOUMSSI 2015-04-28T23:28:10Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160516#M45364 <P>a list of all source ip's and a list of all destination ip's for any given destination port. the way you have it shows each ip talking together i dont need that. I just need a list of the ip's not whats talking to what.</P> Tue, 28 Apr 2015 23:31:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160516#M45364 tve784 2015-04-28T23:31:29Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160517#M45365 <P>for example, if you've number of port 8000, you want something like this?</P> <PRE><CODE>dest_port=8000| table src_ip dest_ip dest_port </CODE></PRE> Tue, 28 Apr 2015 23:46:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160517#M45365 NOUMSSI 2015-04-28T23:46:10Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160518#M45366 <P>no so if you do that it lists out multiple results if there are any. for example if there are 10 src ip's that are 1.1.1.1 it list that 10 times. same with dest ip's. so i guess i need unique source ip's and unique dest ip's. sorry i should have put unique values in my question.</P> Tue, 28 Apr 2015 23:50:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160518#M45366 tve784 2015-04-28T23:50:29Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160519#M45367 <P>i thought i had it with </P> <P>| dedup src_ip | stats list(src_ip), list(dest_ip) by dest_port</P> <P>but its still showing multiple of the same dest ip's</P> Mon, 28 Sep 2020 19:38:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160519#M45367 tve784 2020-09-28T19:38:46Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160520#M45368 <P>Ok now i understand you better. Use de commande <STRONG>dedup</STRONG> to have unique values. Try this:</P> <PRE><CODE>dest_port=8000| dedup src_ip | dedup dest_ip | table src_ip dest_ip dest_port </CODE></PRE> Tue, 28 Apr 2015 23:59:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160520#M45368 NOUMSSI 2015-04-28T23:59:09Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160521#M45369 <P>Hi if you need a list of all source ip's and dest<BR /> ip's that have the same dest port</P> <P>try something like:</P> <P>......|eval src_dest_ip=coalesce(dest_ip,src_ip)|stats values (src_dest_ip)|where ......condition on ip's....</P> Mon, 28 Sep 2020 19:38:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160521#M45369 stephane_cyrill 2020-09-28T19:38:49Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160522#M45370 <P>yep already tried that one too. It cuts out some of the ip's for some reason. So like if i run my 2 separate searches i get 9 total src ip's and 20 total dest ip's. i run this and its only giving me 8 of each. so 1 src ip and 12 dest ip's disappeared.</P> Wed, 29 Apr 2015 00:06:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160522#M45370 tve784 2015-04-29T00:06:10Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160523#M45371 <P>this puts it all into one list i need them in 2 lists one list for src and one list for dest </P> Wed, 29 Apr 2015 00:17:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160523#M45371 tve784 2015-04-29T00:17:00Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160524#M45372 <P>i figured it out</P> <P>| stats values(src_ip),values(dest_ip) by dest_port</P> Mon, 28 Sep 2020 19:38:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160524#M45372 tve784 2020-09-28T19:38:52Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160525#M45373 <P>Thanks, this helped me resolve a similar question. I was trying to get a list single list of website actions by IP address for a given date, and this helped me figure it out:</P> <P>| stats values(actions), earliest(datetime) by src_ip</P> Sat, 06 May 2017 14:51:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-2-searches-to-list-all-source-and-destination/m-p/160525#M45373 taylorgo 2017-05-06T14:51:47Z