Splunk Search

SPL Query to filter the ip used less than 20+users

SabariRajanT
Path Finder

Hi Team,

I have a dashboard where existing results showing Event date, Event title, email id, Logon IP, Logon Location, AD Location.

The condition here is I need to remove the Logon IP used by more than 20+users from my current dashboard and display only Logon IP used by less than 20+ users

 

EG:     index=ert  "192.34.23.122" earliest=-30d | stats dc(user) as "Distinct users"

Using above query if the logon ip 192.34.23.122 used by more than 20+ users then my dashboard doesn't show up.

EG:     index=ert  "192.34.23.122" earliest=-30d | stats dc(user) as "Distinct users"

Using above query if the logon ip 192.34.23.122 used by less than 20+ users then my dashboard should show up.

Please suggest suitable SPL query for this.

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=ert  "192.34.23.122" earliest=-30d | stats dc(user) as "Distinct users" | where 'Distinct users' < 20
0 Karma

SabariRajanT
Path Finder
index=ert  "192.34.23.122" earliest=-30d | stats dc(user) as "Distinct users" | where 'Distinct users' < 20

 

In some condition ip address is not specifically determined, like below

index=ert "IPaddress" like this - how do we return the results now?

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=ert  earliest=-30d | stats dc(user) as "Distinct users" by IPAddress | where 'Distinct users' < 20
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...