Splunk Enterprise

splunk time command question

nnonm111
Path Finder

I would like to know the ip that made status=404 more than 10 times in 10 minutes in a week. Please help me.

field list
ip = src_ip
status = status

Labels (1)
Tags (2)
0 Karma
1 Solution

bowesmana
Super Champion

@nnonm111 

Use the following

You_search status=404
| bin _time span=10m
| stats count by src_ip _time
| where count>10

I would recommend not using the transaction command as that is a very poor performing command to use for this purpose - depending on your data volume and number of IP addresses, you are likely to be a memory hog on the search head and may silently come up against server defined limits.

Using stats is very simple and efficient - the above bin command sets a time window and it will then count the occurrences of each IP within each 10 minute window.

The result set will give you each IP and each 10 minute window where the count exceeded 10. 

 

View solution in original post

0 Karma

bowesmana
Super Champion

@nnonm111 

Use the following

You_search status=404
| bin _time span=10m
| stats count by src_ip _time
| where count>10

I would recommend not using the transaction command as that is a very poor performing command to use for this purpose - depending on your data volume and number of IP addresses, you are likely to be a memory hog on the search head and may silently come up against server defined limits.

Using stats is very simple and efficient - the above bin command sets a time window and it will then count the occurrences of each IP within each 10 minute window.

The result set will give you each IP and each 10 minute window where the count exceeded 10. 

 

View solution in original post

0 Karma

nnonm111
Path Finder

Then I'd like to confirm that you send a ping to another ip more than 10 times in 10 minutes.
Action = Ping
ip = clientip

Tags (2)
0 Karma

danielcj
Path Finder

Hello,

Please verify the following query:

index=<your_index> sourcetype=<your_sourcetype> status=404 
| transaction src_ip maxspan=10m 
| where eventcount > 10


Make sure to define your search time range to be executed in a week.

 

Thanks.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!