Splunk Search

Count of field and count of sources of the field

ehastings1982
Explorer

I have firewall logs coming in. I have a field which is the destination of traffic (dst). I would like to show the total count of the destination field and the count of the unique sources.

So the result would be:

Dst           Total Events     Sources
8.8.8.8        50              25
8.8.8.9        40              35
8.8.8.10       150             95
Tags (2)
0 Karma

ehastings1982
Explorer

Im guessing this was the best way.

0 Karma

ehastings1982
Explorer

I think this does it. Ive done some checks and it appears the numbers line up. Is there a better way or more efficient query I could have written?

dst=* | stats count(dst), dc(host) by dst | sort -num("dc(host)") | rename dst as "Destination IP", count(dst) as "Total Count", dc(host) as "Total Locations"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...