topic Group same source ip ? in Splunk Search

Group same source ip ?

chengyu — Tue, 18 Mar 2014 12:58:11 GMT

Hi sir:

sourcetype=xxx |eval bandwidth=rcvdbyte+sentbyte |eval bandwidth(MB) = round(bandwidth/1024/1024,2) |table srcip,dstip,...,bandwidth(MB)|sort bandwidth(MB) desc

now:
srcip dstip ..... bandwidth(MB)
1.1.1.1 2.2.2.2 .... 100
1.1.1.1 2.2.2.2 .... 200
1.1.1.2 2.2.2.2 .... 200

I hope :

srcip dstip ..... bandwidth(MB)
1.1.1.1 2.2.2.2 .... 300
1.1.1.2 2.2.2.2 .... 200

what can i do?

Re: Group same source ip ?

MuS — Tue, 18 Mar 2014 13:03:38 GMT

Hi chengyu,

try this:

sourcetype=xxx | eval bandwidth=rcvdbyte+sentbyte | eval bandwidth(MB) = round(bandwidth/1024/1024,2) | stats values(bandwidth(MB)) AS bandwidth by srcip,dstip,...,bandwidth(MB) | sort bandwidth desc

cheers, MuS

Re: Group same source ip ?

somesoni2 — Tue, 18 Mar 2014 14:16:35 GMT

Try this

sourcetype=xxx |eval bandwidth=rcvdbyte+sentbyte |eval bandwidth(MB) = round(bandwidth/1024/1024,2) |stats sum(bandwidth(MB)) as bandwidth(MB) by srcip,dstip,...| sort bandwidth(MB) desc

Re: Group same source ip ?

chengyu — Wed, 19 Mar 2014 04:48:13 GMT

I'm try it, is working fine.

sourcetype=xxx srcip | eval bandwidth=rcvdbyte+sentbyte | eval bandwidth(MB) = round(bandwidth/1024/1024,2) | stats list(dstip) as dstip , values(hostname) as hostname ,values(app) as app,sum(bandwidth(MB)) as bandwidth(MB) by srcip | sort bandwidth(MB) desc

Re: Group same source ip ?

chengyu — Wed, 19 Mar 2014 04:48:39 GMT

Thank you~