Top 10 ip addresses denied over last 7 days

[ryanmims]

Trying to write a search that will show top 10 "repeat" offenders over last 7 days. I'm guessing an eval(if) statement but not really sure. Only want to see repeat srcip's, not IP's that only get denied during 1 day.

Any help would be greatly appreciated.
Thanx

[ryanmims]

This one works. Tweaking...Thanx Martin

[martin_mueller]

How 'bout this then?

index=yourIndex sourcetype=yourSourceType earliest=-7d@d | eventstats dc(date_mday) as days by src_ip | where days > 1 | top limit=10 src_ip

[richgalloway · Accepted solution]

Try this. It will give you the top 10 repeat offenders, but depending on your data they may all be on the same day.

'... | stats count(_time) AS Occurs by src_ip | where Occurs > 6 | top limit=10 Occurs,src_ip | ...'

[richgalloway]

I think it will. See martin_mueller's comment.

[ryanmims]

Would (date_mday) work better than _time to make sure it is only counting the days rather than time entries?

[ryanmims]

No, it works but need only IP
s with date returned if they have been denied more than 1 day over search period

[somesoni2]

something like this will work?

index=yourIndex sourcetype=yourSourceType earliest=-7d@d | top limit=10 src_ip