Splunk Search

Can I count lines in table cell?

yossefn
Path Finder

Hi,

I have a search to show the number of times an IP address was trying to reach some Customer IDs.
How can I count the number of CustIds and present just if there are more than 2 in a cell?

Attached the search and results:

original search
| stats count by CustId, IpAddress
| search count>10
| sort -count
| stats list(CustId) as CustId, list(count) as Count, sum(count) as Total by IpAddress
| sort -Total
| head 10


IpAddress            CustId Count   Total
62.90.19.22           306352113 84  84

84.28.28.232          60555283   70 84
                      23070955   14

141.26.208.180      32370266     42 73
                      205539923 31
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use mvcount.

| stats count by CustId, IpAddress
| search count>10
| stats list(CustId) as CustId, list(count) as Count, sum(count) as Total by IpAddress
| where mvcount(CustId) > 1
| sort 10 - Total
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use mvcount.

| stats count by CustId, IpAddress
| search count>10
| stats list(CustId) as CustId, list(count) as Count, sum(count) as Total by IpAddress
| where mvcount(CustId) > 1
| sort 10 - Total
---
If this reply helps you, an upvote would be appreciated.

yossefn
Path Finder

Working great, thank you!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...