Search 1hr using IPs from 24hr

[mztopp]

How would I take a 24 hour search such as: index=* | iplocation src_ip | stats count by src_ip, Country, dest_ip, dest_port | sort 10 -count     that can effectively use the IPs from a 24 hour search, to search for the traffic in the last hour (using the same 10 IPs from the 24hr not the most popular from the last hour)? I have tried to bucket _time span=1hr, but that just searches through for the most active ips in the last hour and changes what I need. Any suggestions are appreciated!

[ITWhisperer]

Something like this - use eventstats to find the most popular src_ip Country dest_ip etc (whatever criteria you want); sort descending by count and criteria just in case more than one combination has the same count; establish a combined key for the combination,; use streamstats based on this key to determine a rank; filter based on established rank; filter based on time criteria; calculate counts for surviving events

index=* 
| iplocation src_ip 
| eventstats count by src_ip, Country, dest_ip, dest_port 
| sort -count src_ip Country dest_ip dest_port
| eval key=src_ip.":".Country.":".dest_ip.":".dest_port
| streamstats dc(key) as rank
| where rank <= 10
| fields - rank key count
| where _time > relative_time(now(),"-1h@m")
| stats count by src_ip, Country, dest_ip, dest_port

[manjunathmeti]

hi @mztopp,

If field src_ip is part of the index then you can try this:

index=index earliest=-1h [search index=index earliest=-24h | top limit=10 src_ip | fields src_ip | format] | iplocation src_ip | stats count by src_ip, Country, dest_ip, dest_port

If this reply helps you, an upvote/like would be appreciated.

[mztopp]

Just to be clear, my hope is to use this data for a report, so ideally I would be able to accomplish this all in one single search.

[mztopp]

I ended up using a separate lookup to store the IPs. Not really ideal, but I wasn't getting the results I was looking for. Thanks for the help!