Splunk Search

How many people login with the same IP in the same hour using stats?



I have a problem with "stats count by" command.
I have login, ip and hour.
I want to know how many people have same ip in same hour.
I make that :

| stats values(login) AS login, count by hour,ip

I want that :
IP Login Hour
x.x.x.1 login1 hour1
But i have that:
x.x.x.1 login1 hour1
login2 hour1
x.x.x.1 login3 hour1
I don't know why i have that. . .
Ip/login/hour have the same format (they come from to csv).

I try to change hour to timestamp format but the result is the same.


Tags (2)

Revered Legend

Check if there are any extra space in the values of ip or hour.

0 Karma



I'm not sure why "login3" is in another group.

Could you try the following search commands?

your_search | stats values(login) values(hour) by ip
your_search | stats values(login) values(ip) by hour

You may find some reasons why you got your results which you don't expect.

And if you want to get the number of distinct users, I ask you to use "dc()" in stats.

| stats count dc(login) values(login) by ip, hour

Thank you.

0 Karma

Revered Legend

Try running this

|stats values(loging) as login, count(login) as count by hour,ip

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!