Splunk Search

Increase count of events but no field results show up

superstarmd
New Member

When searching with this sample query, results show up like below

index=abc sourcetype=def 1.1.1.1

For example, field1 has the following values:

alt text

field2:
alt text

Since each IP needs to be displayed, I wrote this query:

|eval temp=split(field1,",+") | eval IP1=mvindex(temp,0) | eval IP2=mvindex(temp,1) | eval IP3=mvindex(temp,2)

But there's also a requirement to search for total events >= 1000 and still able to display the 3 IPs in a table along with values(field2). When I use count >= 5, results are displayed, but when I use count >= 1000, the results are not. For example: below is expected result

_time   IP1 IP2 IP3 field2
4/8/2019 23:16  1.1.1.1 2.3.4.5 6.7.8.9 /ccss/custom/etc    
                                                     /ccss/custom/etc1
4/8/2019 23:16  1.1.1.1 2.3.4.5 6.7.8.10    /ccss/custom/etc      
                                                    /ccss/custom/etc2
4/8/2019 23:16  1.1.1.1 2.3.4.5 6.7.8.11     /ccss/custom/etc      
                                                   /ccss/custom/etc3

This is my query so far:

index=abc sourcetype=def 1.1.1.1 
   |eval temp=split(field1,",+") | eval IP1=mvindex(temp,0) | eval IP2=mvindex(temp,1) | eval IP3=mvindex(temp,2)
 | stats values(field2) as field2 count(field1) as event_count by IP1 IP2 IP3 _time | where event_count >=1000
Tags (2)
0 Karma

woodcock
Esteemed Legend

You may not be aware that all the *stats commands and functions are multivalue-aware/safe, so try this:

index=abc sourcetype=def 1.1.1.1 
|eval IP=split(field1,",+")
| stats values(field2) AS field2 count(field1) AS event_count BY IP _time
| where event_count >=1000

I am skeptical that you need the _time there, but I am trusting you on that part. Perhaps this is more what you need?

index=abc sourcetype=def 1.1.1.1 
|eval IP=split(field1,",+")
| stats count AS event_count BY IP field1
| stats list(*) AS * sum(event_count) AS total_event_count BY IP
| where total_event_count >=1000
0 Karma

superstarmd
New Member

I still got the "No results found." message even though there are more than 1000 events found..When I lowered it to 5 I got some results.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...