Splunk Search

Cisco IPS Top Signature by top hosts

cgekoski
Path Finder

New to the splunk community and still learning the way of searches. In a nutshell i want to do a search against a cisco IPS sensor for top 5 signatures over 24hours. Easy to do but how can i then take that result and say top signature show me the top src_ip's. I was thinking that i could pipe the results into another top limit=5 src_ip but no luck. Ive even tried doing top limit=1 signature. Thinking something with append maybe?

host=IPSSensor1 | top limit=5 signature

sig count percent
5474 9289 86.304934
3653 1114 10.350274
1208 116 1.077766
1204 66 0.613212
11020 60 0.557465

Thanks,

Cory

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

To show the top 5 ips for the top signature you can run this search:

host=ipssensor1 [search host=ipssensor1 | top 1 signature | fields signature] | top 5 src_ip

The subsearch in square brackes will evaluate to signature=5474 which is used by the outer search as a filter.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

To show the top 5 ips for the top signature you can run this search:

host=ipssensor1 [search host=ipssensor1 | top 1 signature | fields signature] | top 5 src_ip

The subsearch in square brackes will evaluate to signature=5474 which is used by the outer search as a filter.

cgekoski
Path Finder

Thanks Martin. Powerful search string once i added a time range to my dashboard.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...