Splunk Search

How can I create a table of my search results with a count of each matching dest_ip value?

bayman
Path Finder

I have this search of events:

eventtype=cisco-firewall src_ip="*" (dest_ip="192.168.1.2" OR dest_ip="192.168.2.2" OR dest_ip="10.10.1.1" ) 

For each src_ip, I'd like to list the dest_ip and the count of src_ip so it'd like look

src_ip          | dest_ip                | count
212.123.123.123 | 192.168.1.2, 10.10.1.1 | 123
215.123.123.123 | 192.168.1.2, 10.10.1.1 | 55
214.23.23.23    | 192.168.2.2            | 894
211.45.55.55    | 192.168.1.2, 192.168.2.2, 10.10.1.1 | 235
0 Karma

mydog8it
Builder

your search
| stats count by src_ip dest_ip
| stats list(dest_ip), list(count) by src_ip

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...