topic Re: How do I perform this awk command in Splunk? in Splunk Search

How do I perform this awk command in Splunk?

Johnvey — Tue, 20 Apr 2010 08:03:09 GMT

I would like to use the following cmd in splunk and I am getting errors.

egrep "Failed password" auth.log | awk '{print $13}' | sort | uniq -c | sort -rn | less

Is this possible?

(cross-posted from forums)

Re: How do I perform this awk command in Splunk?

cfield — Tue, 20 Apr 2010 09:05:53 GMT

try something along the lines of:

source=auth.log Failed password | rex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | stats count by src_ip | sort -count

this should produce a table of ip addresses and the count of the time they were in the logfile.

Re: How do I perform this awk command in Splunk?

Johnvey — Mon, 28 Sep 2020 09:11:36 GMT

The clause "stats count by src_ip | sort -count" can be replaced with "top src_ip". The difference is that the "top" command will also add a "percent" field to the results.

Re: How do I perform this awk command in Splunk?

cfield — Mon, 10 May 2010 22:54:56 GMT

One caveat though, top will truncate the result set based on the limit= parameter, you would have to use limit=0 to get the same results.