https://community.splunk.com/t5/Splunk-Search/How-to-search-for-IP-addresses-that-have-been-hit-on-more-than/m-p/273197#M82329 <P>I have been trying to figure out on how to do a search for IP addresses that were hit on more than one Port in a short period of time. </P> Tue, 15 Dec 2015 23:00:44 GMT Securitas 2015-12-15T23:00:44Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-IP-addresses-that-have-been-hit-on-more-than/m-p/273197#M82329 <P>I have been trying to figure out on how to do a search for IP addresses that were hit on more than one Port in a short period of time. </P> Tue, 15 Dec 2015 23:00:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-IP-addresses-that-have-been-hit-on-more-than/m-p/273197#M82329 Securitas 2015-12-15T23:00:44Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-IP-addresses-that-have-been-hit-on-more-than/m-p/273198#M82330 <P>Hi Securitas,</P> <P>all based on assumption, because you did not provide sample data and the search you're using - so I'll use a basic run everywhere example to construct an event and a search. I indexed a file containing this data as <CODE>sourcetype=ip_port</CODE>:</P> <PRE><CODE>time=10:01 ip=1.1.1.1 port=22 time=10:02 ip=1.1.1.1 port=23 time=10:02 ip=2.2.2.2 port=23 time=10:02 ip=2.2.2.2 port=21 time=10:03 ip=1.1.1.1 port=80 </CODE></PRE> <P>Running this search will return connects to more than one port by time:</P> <PRE><CODE>sourcetype="ip_port" | stats count(port) AS Port_count by time, ip | where Port_count&gt;1 </CODE></PRE> <P>If you want to check over 2 minutes use this search (Note: the first line is only needed to construct a useable <CODE>_time</CODE> value):</P> <PRE><CODE>sourcetype="ip_port" | addinfo | eval _time=_indextime | bin _time span=2min | stats count(port) AS Port_count by _time, ip | where Port_count&gt;1 </CODE></PRE> <P>If you want to see which IP's got connection to the same port at the same time use this:</P> <PRE><CODE>sourcetype="ip_port" | chart values(port) AS ports over time by ip </CODE></PRE> <P>Hope this helps to get you started ...</P> <P>cheers, MuS</P> Tue, 15 Dec 2015 23:56:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-IP-addresses-that-have-been-hit-on-more-than/m-p/273198#M82330 MuS 2015-12-15T23:56:52Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-IP-addresses-that-have-been-hit-on-more-than/m-p/273199#M82331 <P>Thanks. That's within the confines of what I was looking for.</P> <P>Cheers Mate.</P> Wed, 16 Dec 2015 18:45:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-IP-addresses-that-have-been-hit-on-more-than/m-p/273199#M82331 Securitas 2015-12-16T18:45:36Z