Splunk Search

How to write query to detect too much blocked traffic to one single destination?

Pooja_R
Loves-to-Learn Lots

I have created a query to detect too much blocked traffic to one single destination.Somehow this doesn't work. Help me to resolve this.

bin _time span = 5m as timespan | eval start time = strptime(connection_start_time,"%Y-%m-%d %H:%M:%S")

|stats dc(D_IP)as num values (start_time)by src_ip | search num>3 | sort num desc

I want to display the src ip,hostname,destination ip, count

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Pooja_R,

I agree with @yuanliu , could you better describe what in your search don't work?

Anyway, to display a value field in a stats command, you can use the values() option, something like this:

<your_search>
| bin _time span = 5m 
| stats 
   dc(D_IP)as dest_ip_count 
   earliest(_time) AS start_time 
   values(host) AS hostname 
   values(dest_ip) AS dest_ip 
   BY src_ip 
| search dest_ip_count>3 
| eval start_time=strptime(connection_start_time,"%Y-%m-%d %H:%M:%S")
| sort -dest_ip_count

Ciao.

Giuseppe

0 Karma

yuanliu
SplunkTrust
SplunkTrust

First, it is imperative to show sample data.  Second, the phrase "doesn't work" conveys very little information.  You kind of described what you expect, but didn't provide sample output to demonstrate what "doesn't work".

Now, to your query - again, I have nothing to base this on except comparing your stats command with your desired output: the stats command as written will give out fields "num", `values(start_time)`, and "src_ip"; it will not give hostname and destination_ip.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...