Splunk Search

Check connection from same source to multiple destination

SIEMStudent
Path Finder

Hi guys,

I have a doubt regarding the mapping of connection from the same source IP to different destination IP.

In my query, I have to check if the same source reach more than 300 different destination IP.

Usually, If I had to report connection with source ip which appear more than 300 times, I know I can to write:

 

|stats count src_ip as source by source
|where count > 300 

 

But what about if I have to check the query requirements?

It shuold be something like:

|stats count src_ip as source, dest_ip as destination by source
|where destination > 300 

?

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @SIEMStudent,

You can try below;

| stats dc(dest_ip) as dest_count by src_ip
| where dest_count > 300 
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @SIEMStudent,

You can try below;

| stats dc(dest_ip) as dest_count by src_ip
| where dest_count > 300 
If this reply helps you an upvote and "Accept as Solution" is appreciated.

SIEMStudent
Path Finder

Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...