Splunk Search

Count values of grouped key

dav_muel
Engager

I have logs like this:

user=userA ip=1.1.1.1 ...
user=userA ip=1.1.1.2 ...
user=userB ip=1.1.2.1 ...
user=userB ip=1.1.2.1 ...
user=userC ip=1.1.3.1 ...
user=userC ip=1.1.3.2 ...
user=userC ip=1.1.3.3 ...

Now I want to have a list of all users with their IPs and the count of the different IPs.

First I do this:

======
search foobar
| stats values(user) by ip
======

Result is:

userA1.1.1.1
1.1.1.2
userB1.1.2.1
userC1.1.3.1
1.1.3.2
1.1.3.3

 

How do I count and display the IPs? It should look like this:

userA1.1.1.1
1.1.1.2
2
userB1.1.2.11
userC1.1.3.1
1.1.3.2
1.1.3.3
 3
Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

Hi @dav_muel ,

This should work:

search foobar
| stats values(ip) as ips by user
| eval ipcount=mvcount(ips)

 
BR
Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

 

base search | stats dc(ip) as IP_COUNT values(ip) as ip_list by User

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

somesoni2
Revered Legend

You can call multiple function in stats. Like this

 

search foobar
| stats values(ip) as ips_used dc(ips) as ips_count by user
0 Karma

rnowitzki
Builder

Hi @dav_muel ,

This should work:

search foobar
| stats values(ip) as ips by user
| eval ipcount=mvcount(ips)

 
BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...