Getting Data In
Highlighted

Count number of events from IIS logs.

New Member

I would like to group it by Country, source IP, destination IP, sum(csbytes), sum(scbytes) where the country is the United States and count is greater than 1000. So far I have the | | iplocation c_ip | where Country="United States". However, when I do the stats count by all the fields I get a count of 1.

It is meant to look like this:

Country | Source IP | Dest IP | sum(csbytes) | sum(csbytes) | count

United States | 10.x.x.x | 195.x.x.x | 25,222,222 | 5,565,454 | 4000

0 Karma
Highlighted

Re: Count number of events from IIS logs.

SplunkTrust
SplunkTrust

Please share your query.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Count number of events from IIS logs.

SplunkTrust
SplunkTrust

If you're already doing a |stats before the | iplocation..., then you final statsshould say sum(count) not just count. As @richgalloway suggested, share you full query for better/direct answer.

0 Karma
Highlighted

Re: Count number of events from IIS logs.

New Member

sourcetype=iis host=a OR host=B or host=C earliest=05/12/2018:0:0:0 earliest=05/13/2018:0:0:0
| iplocation cip | where Country="United States
| eventstats c as "Event Count" sum(sc
bytes) as scbytes sum(csbytes) as csbytes by cip
| dedup cip
| table Country c
ip destip csbytes sc_bytes "Event Count"

This is my query thank you very much!
@somesoni2 and @richgalloway

0 Karma
Highlighted

Re: Count number of events from IIS logs.

Legend

@tundeawe, If you want to show communication between each cip and destip, please try the following:

sourcetype=iis host=a OR host=B or host=C earliest=05/12/2018:0:0:0 earliest=05/13/2018:0:0:0
| stats count as EventCount sum(sc_bytes) as sc_bytes sum(cs_bytes) as cs_bytes by c_ip, dest_ip
| iplocation c_ip
| where Country="United States
| table Country c_ip dest_ip cs_bytes sc_bytes "Event Count"

If you want to show it only based on cip (without destip or latest destip or with a list of destips, which seems to be the case based on dedup c_ip that you have performed)

sourcetype=iis host=a OR host=B or host=C earliest=05/12/2018:0:0:0 earliest=05/13/2018:0:0:0
| stats count as EventCount sum(sc_bytes) as sc_bytes sum(cs_bytes) as cs_bytes values(dest_ip) as dest_ip by c_ip
| iplocation c_ip
| where Country="United States
| table Country c_ip dest_ip cs_bytes sc_bytes "Event Count"

View solution in original post

0 Karma
Highlighted

Re: Count number of events from IIS logs.

New Member

thanks you!

0 Karma
Highlighted

Re: Count number of events from IIS logs.

Legend

@tundeawe, I am glad you found this useful! I have converted my comment to answer. Please Accept to mark this question as answered!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.