Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Multiple top results against IP address
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Alright this may seem like a trivial question for some of you Splunkers. I'm new at this:
I'm trying to get the results of a top (n) inside_port for multiple inside_ip.
search string:
inside_ip=xxx.xxx.223.221 OR inside_ip=xxx.xxx.220.224 | top 5 inside_port
results returned:
inside_ip | inside_port | count | percent
223.221 | 22,80,443 | 6,3,1 | 60,30,10
220.224 | 443,3389,22 | 12,6,2 | 60,30,10
or alternative results:
inside_ip | inside_port | count | percent
223.221 | 22 | 6 | 60
223.221 | 80 | 3 | 30
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
would "top 5 inside_port by inside_ip" get you what your looking for?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you post a _raw sanitized sample?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
would "top 5 inside_port by inside_ip" get you what your looking for?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
lol! Just check out docs.splunk, it's not 1/2 as bad as other product doco i've used in the past as it provides decent examples to better explain some of the concepts behind the actual commands.
http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Top
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked perfectly! I don't know who you are, or where you came from, but I owe you a gift! This is going to work perfect, and probably kill the server hahaha!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
