I'm new to Splunk we just started using it recently so please forgive the newbie question.
Current search:
sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode" | table severity signature src src_port dest dest_port
Results in:
severity signature src src_port dest dest_port
I want to modify the search to provide a summary of the number of events comming from each src IP to the dest IP and be able to sort by that count.
Desired:
severity signature src dest dest_port count
I've tried a few different searches such as this one:
sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode" | stats count by src | sort -num(count) | table severity signature src dest dest_port count
However this only populates the src and count column. I'm not quite sure what I'm missing.
I would say this is the most direct way of implementing what you are looking for:
sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode" | top severity,signature,src,src_port,dest,dest_port limit=50
If you use a stats, only the fields and results that are in the stats will exists after.
the basic search will be
sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode"
| stats count by severity signature src dest dest_port
| sort -num(count)
and if you just want the count per src and dest, you can group the others fields in a multiline result
sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode"
| stats count values(severity) AS list_severity values(signature) AS list_signature values(dest_port) AS list_dest_port by src dest
| sort -num(count)
This works?
your search | stats count by severity src dest dest_port signature
/k
I would say this is the most direct way of implementing what you are looking for:
sourcetype=suricata* NOT tag=dev_profiler severity="high" signature="ET SHELLCODE Possible Call with No Offset UDP Shellcode" | top severity,signature,src,src_port,dest,dest_port limit=50
Works perfectly... thanks for such a quick reply. I didn't even think of the top command I was stuck on using count and sort.
Thanks again.