Splunk Search

How to create a query wit top notable event sources with HOSTNAME?

tokio13
Path Finder

Hello

Could someone help me with a query?

I have this default report Top Notable Event Sources which returns me IP's (count, sparkline etc). How can I add an extra column to have the hostname of those IP's? 

 

Labels (1)
Tags (1)
0 Karma

tokio13
Path Finder

Yes,  for that one

0 Karma

Azeemering
Builder

Then your answer is in my first reply 🙂

0 Karma

tokio13
Path Finder

It actually worked only if I mention the Indexer, but that looks to consume quite a lot of resources 

Tags (1)
0 Karma

Azeemering
Builder

Hi,

You could just add the field host to the search. It will then show under Statistics.
This is for the Search "Notable - Top Notable Event Sources" in Enterprise Security if that is what you mean?

| `es_notable_events` | search timeDiff_type=current src!=unknown | stats sparkline(sum(count),30m) as sparkline,dc(rule_name) as correlation_search_count,dc(security_domain) as security_domain_count,sum(count) as count by src, host
| sort 100 - count,correlation_search_count

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...