Splunk Search

Linux Equivalent commmand in Splunk

Samiksha1008
Observer

I have below command in Linux -

grep "login?" access.log access.log.1 | grep https | cut -d, -f3 | sed 's/"wafip"://g' | sort -n | uniq -c | sort -nr | head -100

 

I need to find out equivalent Splunk command. 
I know the index and host. 

Can somebody please help me with this?

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

can you tell what you want to get from log and give examples with log and output of your onliner?

r. Ismo

0 Karma

Samiksha1008
Observer

Hi @isoutamo 

I want to fetch ip addresses from the logs and display on the splunk. 

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Source and destination addresses or any other what there could be?

Can you give example of your access.log (anonymised)?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...