Splunk Search
Highlighted

How do I perform this awk command in Splunk?

Contributor

I would like to use the following cmd in splunk and I am getting errors.

egrep "Failed password" auth.log | awk '{print $13}' | sort | uniq -c | sort -rn | less

Is this possible?

(cross-posted from forums)

Tags (1)
Highlighted

Re: How do I perform this awk command in Splunk?

Engager

try something along the lines of:

source=auth.log Failed password | rex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | stats count by src_ip | sort -count

this should produce a table of ip addresses and the count of the time they were in the logfile.

Highlighted

Re: How do I perform this awk command in Splunk?

Contributor

The clause "stats count by srcip | sort -count" can be replaced with "top srcip". The difference is that the "top" command will also add a "percent" field to the results.

0 Karma
Highlighted

Re: How do I perform this awk command in Splunk?

Engager

One caveat though, top will truncate the result set based on the limit= parameter, you would have to use limit=0 to get the same results.

0 Karma