How do I perform this awk command in Splunk?

[Johnvey]

I would like to use the following cmd in splunk and I am getting errors.

egrep "Failed password" auth.log | awk '{print $13}' | sort | uniq -c | sort -rn | less

Is this possible?

(cross-posted from forums)

[cfield]

try something along the lines of:

source=auth.log Failed password | rex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | stats count by src_ip | sort -count

this should produce a table of ip addresses and the count of the time they were in the logfile.

[cfield]

One caveat though, top will truncate the result set based on the limit= parameter, you would have to use limit=0 to get the same results.

[Johnvey]

The clause "stats count by src_ip | sort -count" can be replaced with "top src_ip". The difference is that the "top" command will also add a "percent" field to the results.