Splunk Search

Limiting a Search by number of events over a period of time

RyanDonnelly22
Explorer

I am trying to search for a number of events over a select period of time (4 hours) and then expand that to see how much of this traffic is in a 30 day period. I can use the time ranger picker for the initial 4 hours, but when expand it, I am getting too much data. 

Search I am using:

index="Firewalls" action=blocked

| stats count by client_ip

| search count > 3500

| sort -count

Is there a way to limit the results to be something like "search count > 3500 over 4 hours" and have the time range be 30 days?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

There are at least two different methods. One is to generate set of timeranges and run separate search limiting results to your desired limit for each timerange using map command. A bit ugly and spawns many subsearches.

Second one would be to search for all the values but add a "counter" for each hour using streamstats and return only those results which counter is less or equal to the limit. Uses just one search,  but still needs to search throughout the whole outer timerange.

I'm far from my computer ATM so I won't write SPL...

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...