Splunk Search

How to count distinct IPs from a given country

New Member

I am trying to parse a syslog input to count the number of distinct IPs for a given country. My search string is

 iplocation src_ip | stats sparkline count by Country | sort - count | head 10

I'd like to add a column after "count" that displays the number of unique source IP for a given country. Is this possible?

0 Karma
1 Solution

Communicator

Hello,

Maybe you can try this?

iplocation src_ip | stats sparkline count, dc(src_ip) by Country | sort - count | head 10

Kind regards,
Willem

View solution in original post

0 Karma

Communicator

Hello,

Maybe you can try this?

iplocation src_ip | stats sparkline count, dc(src_ip) by Country | sort - count | head 10

Kind regards,
Willem

View solution in original post

0 Karma