Getting Data In

Count number of events from IIS logs.

tundeawe
New Member

I would like to group it by Country, source IP, destination IP, sum(cs_bytes), sum(sc_bytes) where the country is the United States and count is greater than 1000. So far I have the | | iplocation c_ip | where Country="United States". However, when I do the stats count by all the fields I get a count of 1.

It is meant to look like this:

Country | Source IP | Dest IP | sum(cs_bytes) | sum(cs_bytes) | count

United States | 10.x.x.x | 195.x.x.x | 25,222,222 | 5,565,454 | 4000

0 Karma
1 Solution

niketnilay
Legend

@tundeawe, If you want to show communication between each c_ip and dest_ip, please try the following:

sourcetype=iis host=a OR host=B or host=C earliest=05/12/2018:0:0:0 earliest=05/13/2018:0:0:0
| stats count as EventCount sum(sc_bytes) as sc_bytes sum(cs_bytes) as cs_bytes by c_ip, dest_ip
| iplocation c_ip
| where Country="United States
| table Country c_ip dest_ip cs_bytes sc_bytes "Event Count"

If you want to show it only based on c_ip (without dest_ip or latest dest_ip or with a list of dest_ips, which seems to be the case based on dedup c_ip that you have performed)

sourcetype=iis host=a OR host=B or host=C earliest=05/12/2018:0:0:0 earliest=05/13/2018:0:0:0
| stats count as EventCount sum(sc_bytes) as sc_bytes sum(cs_bytes) as cs_bytes values(dest_ip) as dest_ip by c_ip
| iplocation c_ip
| where Country="United States
| table Country c_ip dest_ip cs_bytes sc_bytes "Event Count"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketnilay
Legend

@tundeawe, If you want to show communication between each c_ip and dest_ip, please try the following:

sourcetype=iis host=a OR host=B or host=C earliest=05/12/2018:0:0:0 earliest=05/13/2018:0:0:0
| stats count as EventCount sum(sc_bytes) as sc_bytes sum(cs_bytes) as cs_bytes by c_ip, dest_ip
| iplocation c_ip
| where Country="United States
| table Country c_ip dest_ip cs_bytes sc_bytes "Event Count"

If you want to show it only based on c_ip (without dest_ip or latest dest_ip or with a list of dest_ips, which seems to be the case based on dedup c_ip that you have performed)

sourcetype=iis host=a OR host=B or host=C earliest=05/12/2018:0:0:0 earliest=05/13/2018:0:0:0
| stats count as EventCount sum(sc_bytes) as sc_bytes sum(cs_bytes) as cs_bytes values(dest_ip) as dest_ip by c_ip
| iplocation c_ip
| where Country="United States
| table Country c_ip dest_ip cs_bytes sc_bytes "Event Count"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

tundeawe
New Member

thanks you!

0 Karma

niketnilay
Legend

@tundeawe, I am glad you found this useful! I have converted my comment to answer. Please Accept to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share your query.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

somesoni2
Revered Legend

If you're already doing a |stats before the | iplocation..., then you final statsshould say sum(count) not just count. As @richgalloway suggested, share you full query for better/direct answer.

0 Karma

tundeawe
New Member

sourcetype=iis host=a OR host=B or host=C earliest=05/12/2018:0:0:0 earliest=05/13/2018:0:0:0
| iplocation c_ip | where Country="United States
| eventstats c as "Event Count" sum(sc_bytes) as sc_bytes sum(cs_bytes) as cs_bytes by c_ip
| dedup c_ip
| table Country c_ip dest_ip cs_bytes sc_bytes "Event Count"

This is my query thank you very much!
@somesoni2 and @richgalloway

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...