5 or more different destination IP, one IDS attack name, all in 1h query

[PiotrAp]

Hi,

I'm trying to create a query which will display events matching following conditions: 5 or more different destination IP, one IDS attack name, all in 1h.

I tried to use following:

index=ids
| streamstats count time_window=1h by dest_ip attack_name
| where count (attack_name=1 AND dest_ip>=5)

but it is not accepted by Splunk so I presume it has to be written differently. Could somebody help me please?

[richgalloway · Accepted solution]

If there are events from 5 different IP addresses with the same attack name then a count by dest_ip and attack_name will produce 5 events with a count of 1.  Very likely not what you're looking for.  Instead, count the number of IP address for each attack name and keep the results where the count is at least 5.

index=ids
| streamstats distinct_count(dest_ip) as count time_window=1h by attack_name
| where count >= 5

[PiotrAp]

This is exactly what I'm looking for. Many thanks for your help!