topic Re: List of top client IP's each with their most common user agent in Splunk Search

List of top client IP's each with their most common user agent

soundchaos — Mon, 28 Sep 2020 16:48:18 GMT

I am trying to find a search command that will get me a list of my top 20 client ip addresses (c_ip) along with each given ip's top 1 user agent (cs_User_Agent_).

In laymans code: ... | top 20 c_ip each with top cs_User_Agent_

Re: List of top client IP's each with their most common user agent

somesoni2 — Thu, 05 Jun 2014 20:47:41 GMT

Try this

index=yourIndex sourcetype=yourSourcetype [search index=yourIndex sourcetype=yourSourcetype| top 20 c_ip | table c_ip]| stats count by c_ip,cs_User_Agent_ | sort - count | streamstats count as sno by c_ip | where sno=1 | table c_ip,cs_User_Agent_

Re: List of top client IP's each with their most common user agent

soundchaos — Fri, 06 Jun 2014 17:09:42 GMT

Thank you! This is beautiful. Any ideas on how I might also compare each of these top IP's and show a readable list of how many / which user agents are associated, rather than just the single most common one?

Re: List of top client IP's each with their most common user agent

somesoni2 — Fri, 06 Jun 2014 20:09:02 GMT

I sure I got your requirement, but try removing the portion of search after "|sort -count" (streamstats). That will list all user agents associated with respective c_ip.