Splunk Search

Linux Equivalent commmand in Splunk

Samiksha1008
Observer

I have below command in Linux -

grep "login?" access.log access.log.1 | grep https | cut -d, -f3 | sed 's/"wafip"://g' | sort -n | uniq -c | sort -nr | head -100

 

I need to find out equivalent Splunk command. 
I know the index and host. 

Can somebody please help me with this?

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

can you tell what you want to get from log and give examples with log and output of your onliner?

r. Ismo

0 Karma

Samiksha1008
Observer

Hi @isoutamo 

I want to fetch ip addresses from the logs and display on the splunk. 

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Source and destination addresses or any other what there could be?

Can you give example of your access.log (anonymised)?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Video | Welcome Back to Smartness, Pedro

Remember Splunk Community member, Pedro Borges? If you tuned into Episode 2 of our Smartness interview series, ...

Detector Best Practices: Static Thresholds

Introduction In observability monitoring, static thresholds are used to monitor fixed, known values within ...

Expert Tips from Splunk Education, Observability in Action, Plus More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...