topic How to search top 5 IPs with highest distinct count emails per day? in Splunk Search

How to search top 5 IPs with highest distinct count emails per day?

niboucher — Thu, 31 Jul 2014 17:15:13 GMT

Hello,

In each line of the logs ,there is an email, an IP address and a timestamp.

I'd like to calculate for each day the top 1 (or top 5 or top 10) IPs which have the biggest number of distinct emails.

I'm using this

| bin span=1d _time
| stats dc(email) by ip,_time

but this doesn't do the trick since it prints a line for each IP and each day and I don't know to get only the top 5 dc(email) per IP

I'd like the result to look like this

_time        dc(email)    ip

2014-07-28   50           10.1.1.1
             30           1.1.1.2
             20           1.1.1.3
             10           1.1.1.4
             10           1.1.1.4
2014-07-29   120          10.9.1.1
             85           25.1.1.2
             45           34.1.1.3
             35           26.1.1.4
             15           42.1.1.4

Do you guys know how to do this?

Re: How to search top 5 IPs with highest distinct count emails per day?

aelliott — Mon, 28 Sep 2020 17:13:38 GMT

Try something like this:

|bucket _time span=1d | eventstats dc(email) by ip | top limit=5 dc(email),ip by _time |sort -_time, -dc(email)

Re: How to search top 5 IPs with highest distinct count emails per day?

aelliott — Thu, 31 Jul 2014 18:10:31 GMT

Updated the answer, should be good now.

Re: How to search top 5 IPs with highest distinct count emails per day?

somesoni2 — Thu, 31 Jul 2014 18:31:23 GMT

Another way of achieving the same

your base search | bin span=1d _time | stats dc(email) as dc by ip,_time | sort _time,dc | streamstats count by _time | where count < 6

Re: How to search top 5 IPs with highest distinct count emails per day?

martin_mueller — Fri, 01 Aug 2014 22:56:50 GMT

Wouldn't that be where count < 6?

Re: How to search top 5 IPs with highest distinct count emails per day?

somesoni2 — Fri, 01 Aug 2014 23:17:36 GMT

It indeed should be <6. Thanks for pointing it out. I guess I'm in mood for early Friday..