topic Where following a dc(field) in Splunk Search

Where following a dc(field)

stakor — Thu, 30 Nov 2017 20:36:03 GMT

I am looking at a firewall. I am trying to find only results where there are more than 20 distinct ports per source.

stats dc(port) by soure_ipaddr

I would like to use something like a where command. I was thinking of using a | where dc(port) > 20, but I get an error when I try that. What should I do to convert the results of the dc(port) to a value that where can use?

Re: Where following a dc(field)

somesoni2 — Thu, 30 Nov 2017 20:42:48 GMT

You would need to use eventstats command to calculate dc(port) per source_ipaddr (adding another field without reducing/filtering) and then apply your where clause. like this

your base search 
| eventstats dc(port) as ports by soure_ipaddr
| where ports>20
| ...rest of the search

Re: Where following a dc(field)

ddrillic — Thu, 30 Nov 2017 20:43:28 GMT

dc(port) as total .... | where total > 20

Re: Where following a dc(field)

diegofavoretto — Thu, 03 Jan 2019 09:00:55 GMT

is it possible to apply on the filters the dc(account_id) for example ?