Splunk Search

Sub-Domain Count

queme
Explorer

I am looking to pull all domains from dns logs and get a count of how many unique sub-domains that were requested of that domain.

This is what I have so far. I might be going in the wrong direction so if I need to wipe and retry I ok with that.

index=dns | rex field=named_domain "(?([^.]+.)?[^.]+$)" | stats count by named_domain | uniq | table domain, count

My problem is that the count is not the count of the unique sub-domains but instead of I am getting all sub-domains grouped with the domain field.

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

Your rex statement reads "look inside the field called 'named_domain' and capture <something DOT something>, and store the results in a field called 'domain'." Your stats call then sums over the original field named_domain; I suspect you're just dealing with a typo.

If I've missed the mark, maybe you could provide a couple samples lines (enough to spot a pattern) and the desired output?

queme
Explorer

That worked great, thank you!

0 Karma

sowings
Splunk Employee
Splunk Employee

Perhaps stats distinct_count(name_domain) by domain is what you're looking for?

queme
Explorer

The name_domain field contains the entire domain (tap-cdn.rubiconproject.com) and my rex field will pull from that and show just rubiconproject.com. (I found this in one of the answers and it works well) My problem is if there are 100 logs with a request to tap-cdn.rubiconproject.com it will show a count of 100. only want to see 1. If there is another sub-domain tap1-cdn.rubiconproject and tap-cdn.rubiconproject I want it to show 2.

What I want it to look like:

Domain | # of Sub-Domains
Facebook.com 12
abc.com 2

0 Karma

queme
Explorer

Jul 3 02:19:31 query from IP: 1.1.1.1 Port#49335: Name: tap-cdn.rubiconproject.com. Destination: 2.2.2.2 Time: Jul 3 02:19:31

Jul 3 02:19:31 query from IP: 1.1.1.1 Port#65260: Name: api.echoenabled.com. Destination: 2.2.2.2 Time: Jul 3 02:19:31

Jul 3 02:20:56 query from IP: 1.1.1.1 Port#64937: Name: versatables-com.amazonwebstore.com. Destination: 2.2.2.2 Time: Jul 3 02:19:31

I changed the Ips for security reasons.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...