Splunk Query for user accessing assets

[sarwshai]

Hi All,

I need to create a query where user access a same destination from 5 or more sources, also in that query opposite should also be achieved i.e. 5 or more destination and 1 source, is it possible?

[gcusello]

Hi @sarwshai,
you have to use the stats command with the dc (distinct_count) option.
e.g. something like this:

index=your_index
| stats dc(src_ip) AS dc_src BY user dts_ip
| where dc_src>5

or in the other case:

index=your_index
| stats dc(dst_ip) AS dc_dst BY user src_ip
| where dc_dst>5

Ciao.
Giuseppe

[sarwshai]

Thanks @gcusello , however i want both conditions in same search itself.

[gcusello]

Hi @sarwshai,
try something like this (it runs if the second search has less than 50,000 results!):

index=your_index
| stats dc(src) AS dc_src values(src) AS src BY user dst
| where dc_src>5
| append [ search 
     index=your_index
     | stats dc(dst) AS dc_dst values(dst) AS dst BY user src
     | where dc_dst>5
     ]
| table user src dst

Ciao.
Giuseppe

[sarwshai]

Thanks @gcusello , it kind of worked for me.

[gcusello]

Hi @sarwshai,
You're welcome!
if this answer solves your need, please accept it for the other people of Community.

Ciao and next time.
Giuseppe