Splunk Search

Count New IPs Accessed Over Time

ky129q
Engager

We have a daily report that generates an event each time an IP is accessed each day.  In order to determine the number of new IPs accessed today that have never been accessed before we use the following query:

sourcetype=report_900 earliest=-1d@d latest=now NOT 
    [search sourcetype=report_900 earliest=1 latest=-1d@d 
    |  stats count by IPv4Address 
    | table IPv4Address] 
| stats count by IPv4Address
| table IPv4Address
| stats count

What we would like to have is a query that produces a timechart of the the number of new IPs accessed each day.

If the data shows the following IP access for the day  (each letter represents a different IP)

2021/01/01 IPs:  A,B,C,A,A

2021/01/02 IPs: B,D,E,B,E

2021/01/03 IPs: A,D,E,A,A

2021/01/04 IPs: B,C,F,C

We would get the following results:

2021/01/01     3

2021/01/02     2

2021/01/03     0

2021/01/04     1

Any suggestions on how this can be accomplished?

Also, any suggestions on improving the performance of our original query?

 

 

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
sourcetype=report_900 earliest=1 latest=now
| bin _time span=1d
| stats values(IPv4Address) as IPv4Address by _time
| streamstats dc(IPv4Address) as countip
| streamstats window=1 current=f values(countip) as previouscount
| fillnull value=0 previouscount
| eval change=countip-previouscount

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
sourcetype=report_900 earliest=1 latest=now
| bin _time span=1d
| stats values(IPv4Address) as IPv4Address by _time
| streamstats dc(IPv4Address) as countip
| streamstats window=1 current=f values(countip) as previouscount
| fillnull value=0 previouscount
| eval change=countip-previouscount
0 Karma

ky129q
Engager

Exactly what I wanted.  Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...