Getting Data In

Getting too many destination ip addresses. Need to filter it down to 5

ecabrera81
New Member

Trying to filter down to 5 search results for the dest section.

index=threat_activity threat_match_field=src threat_match_value=* | iplocation src | transaction threat_match_value |table src dest dest_port threat_key Country orig_sourcetype | search Country!= "United States" |

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

The transaction command is generating those multivalued fields for src and dest ip addresses. There is no option in transaction command to limit how many values to show, so you'd need to use eval expression, after transaction command to limit the number of results to be show. Like this

For single field (say dest where you want to reduce the number of ip addresses to be shown per event) to be limited to 5 values.

index=threat_activity threat_match_field=src threat_match_value=* | iplocation src | transaction threat_match_value |table src dest dest_port threat_key Country orig_sourcetype | search Country!= "United States" | eval dest=mvindex(dest,0,4)

For multiple fields

index=threat_activity threat_match_field=src threat_match_value=* | iplocation src | transaction threat_match_value |table src dest dest_port threat_key Country orig_sourcetype | search Country!= "United States" | foreach src dest [ eval <<FIELD>>=mvindex('<<FIELD>>',0,4) ]

View solution in original post

0 Karma

somesoni2
Revered Legend

The transaction command is generating those multivalued fields for src and dest ip addresses. There is no option in transaction command to limit how many values to show, so you'd need to use eval expression, after transaction command to limit the number of results to be show. Like this

For single field (say dest where you want to reduce the number of ip addresses to be shown per event) to be limited to 5 values.

index=threat_activity threat_match_field=src threat_match_value=* | iplocation src | transaction threat_match_value |table src dest dest_port threat_key Country orig_sourcetype | search Country!= "United States" | eval dest=mvindex(dest,0,4)

For multiple fields

index=threat_activity threat_match_field=src threat_match_value=* | iplocation src | transaction threat_match_value |table src dest dest_port threat_key Country orig_sourcetype | search Country!= "United States" | foreach src dest [ eval <<FIELD>>=mvindex('<<FIELD>>',0,4) ]
0 Karma

ecabrera81
New Member

Thank you!

0 Karma

somesoni2
Revered Legend

Could you provide more details on what the expected output is (and what you're getting right now)?

0 Karma

ecabrera81
New Member

Thanks for the response. For output i would like for either src or dest section ip address to display only 5 ip addresses for each section. As of now i am just scrolling down too many ip addresses.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>