Search Unique Source IPs Associated with 10+ Unique Destination IPs


Hi all I’m new to Splunk so forgive my ignorance.  We’re currently using Splunk as a SIEM and I’m having trouble getting a search query put together.

What I’m looking for is:

Show me all unique sources that have initiated ICMP traffic.  I believe that I’m getting the correct results with the following search string.

index="indexabc" dest_port=0 | stats count by src_ip

The additional information I’m looking for is “by unique source IP (above) find those that have 10+ unique destination IPs (dest_ip).”

Labels (1)
Tags (3)
0 Karma


Try this.

index="indexabc" dest_port=0 
| stats count, dc(dest_ip) as UniqueDestinations by src_ip
| where UniqueDestinations >= 10
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...