Splunk Search

How many people login with the same IP in the same hour using stats?

RichPierre
Engager

Hi,

I have a problem with "stats count by" command.
I have login, ip and hour.
I want to know how many people have same ip in same hour.
I make that :

| stats values(login) AS login, count by hour,ip

I want that :
IP Login Hour
x.x.x.1 login1 hour1
login2
login3
But i have that:
x.x.x.1 login1 hour1
login2 hour1
x.x.x.1 login3 hour1
I don't know why i have that. . .
Ip/login/hour have the same format (they come from to csv).

I try to change hour to timestamp format but the result is the same.

Sincerely

Tags (2)

somesoni2
Revered Legend

Check if there are any extra space in the values of ip or hour.

0 Karma

Suda
Communicator

Hello,

I'm not sure why "login3" is in another group.

Could you try the following search commands?

your_search | stats values(login) values(hour) by ip
  OR
your_search | stats values(login) values(ip) by hour

You may find some reasons why you got your results which you don't expect.

And if you want to get the number of distinct users, I ask you to use "dc()" in stats.

| stats count dc(login) values(login) by ip, hour

Thank you.

0 Karma

somesoni2
Revered Legend

Try running this

|stats values(loging) as login, count(login) as count by hour,ip

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...