Splunk Search

How many people login with the same IP in the same hour using stats?

Engager

Hi,

I have a problem with "stats count by" command.
I have login, ip and hour.
I want to know how many people have same ip in same hour.
I make that :

| stats values(login) AS login, count by hour,ip

I want that :
IP Login Hour
x.x.x.1 login1 hour1
login2
login3
But i have that:
x.x.x.1 login1 hour1
login2 hour1
x.x.x.1 login3 hour1
I don't know why i have that. . .
Ip/login/hour have the same format (they come from to csv).

I try to change hour to timestamp format but the result is the same.

Sincerely

Tags (2)

SplunkTrust
SplunkTrust

Check if there are any extra space in the values of ip or hour.

0 Karma

Communicator

Hello,

I'm not sure why "login3" is in another group.

Could you try the following search commands?

your_search | stats values(login) values(hour) by ip
  OR
your_search | stats values(login) values(ip) by hour

You may find some reasons why you got your results which you don't expect.

And if you want to get the number of distinct users, I ask you to use "dc()" in stats.

| stats count dc(login) values(login) by ip, hour

Thank you.

0 Karma

SplunkTrust
SplunkTrust

Try running this

|stats values(loging) as login, count(login) as count by hour,ip