Hi mates,
I'm trying to get the most 10 IP addresses with blocked web requests during a month, but the threshold should be using the count of requests during a 10 minutes window.
This is my query so far
index=index-example dest_interface=wan_if sourcetype=source_example action=blocked subtype=webfilter | bucket _time span=10m
| stats count by source_ip URL
| where count > 50
If I use the query above, I will get the IP addresses and URL visited. But, if I search for a month using this query, I will get a sum of the "count" value, getting results of 7,000 for example.
I would like to get an average of the count value, and this way I can see which IP addresses are involved in this type of traffic.
I read about using avg(field), but I cannot decide where to use it. I thought about including "stats avg(count)" but I cannot get results.
Please, any idea would be appreciated.
Thanks !
Like this:
index=index-example dest_interface=wan_if sourcetype=source_example action=blocked subtype=webfilter
| bucket _time span=10m
| stats count BY source_ip URL _time
| stats avg(count) AS count BY source_ip URL
| where count > 50
Like this:
index=index-example dest_interface=wan_if sourcetype=source_example action=blocked subtype=webfilter
| bucket _time span=10m
| stats count BY source_ip URL _time
| stats avg(count) AS count BY source_ip URL
| where count > 50
Sorry for the late response.
Really thank you for your reply, it worked.