Splunk Search

Brute Force Query Help

alanzchan
Path Finder

I am trying to mimic the table below. I have the count of the source IP, but how do I get the count of the respective subnets? In the example, they have it in the cell of each subnet value. Here is what I have so far:

 

index=xxxx sourcetype=xxxx "xxxx" 
| eval ERROR_CODE=case((RC="200"), "Success", (RC="400"), "User Not Found",(RC="401") , "Bad Password",(RC="500"), "Internal Server Error") 
| rex field=_raw "TCIP='(?<subnet_24>\d+\.\d+\.\d+)\.\d+" 
| rex field=_raw "TCIP='(?<subnet_16>\d+\.\d+)\.\d+\.\d+" 
| eval subnet_24 = subnet_24 +".x" 
| eval subnet_16 = subnet_16 +".x.x" 
| stats count(TCIP) by subnet_24 subnet_16 TCIP

 

 

alanzchan_0-1596468056771.png

Any help is appreciated!

Labels (5)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you should try eventstats instead of stats. 

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...