Reporting

Combine Field Values within Top Search

rackersmt
Explorer

Hello,

I currently have a saved search. The command is as follows:

rt_idp (source_address=[ip range]) | top limit=100 source_address, attack_name, threat_severity, source_zone_name, destination_zone_name |  lookup dnsLookup ip as source_address | sort threat_severity, source_address

I'd like to add destination_address as one of the values reported, but if I add the field to the 'top' command, I get multiple lines for each source_address, one per dest. I'm wanting just one line per source, with perhaps the top destination, it's DNS name, and the percentage of attacks from the source that were directed at said top destination.

Anyone know how to accomplish this?

Tags (2)
0 Karma

rackersmt
Explorer

I ended up finding a solution. Thought I'd share:

rt_idp (source_address=[ip range]) | top 100 source_address, destination_address, attack_name, threat_severity, source_zone_name, destination_zone_name | lookup dnsLookup ip as source_address | rename host as src_dns | mvcombine destination_address | eval dst_count=mvcount(destination_address) | eval sample_dst_addr=mvindex(destination_address,0) | lookup dnsLookup ip as sample_dst_addr | rename host as sample_dst_dns | sort threat_severity, source_address | table threat_severity, attack_name, source_address, src_dns, source_zone_name, destination_zone_name, dst_count, sample_dst_addr, sample_dst_dns
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...