Splunk Search

Total count per rule, combined with count per rule,ip,port combination

aaronnicoli
Path Finder

Hi all,

I am going to try and keep this as simple as I can and explain only what I am trying to achieve and what I have to work with...

Okay, so:

I have a search:

index=foo

Which provides data with the fields:

rule_name
dest_ip
dest_port

I want to display the following:

rule_name - count of times the rule occurs - dest_ip - dest_port - count of times "rule_name,dest_ip,dest_port" combination occurs.

Example data:

"foo-rule" "101.101.101.1" "8080"
"foo-rule" "101.101.101.1" "8080"
"foo-rule" "101.101.101.2" "8081"
"bar-rule" "101.101.101.5" "8080"

Example return:

foo-rule - 3 - 101.101.101.1 - 8080 - 2
foo-rule - 3 - 101.101.101.2 - 8081 - 1
bar-rule - 1 - 101.101.101.5 - 8080 - 1

Any ideas???

Thanks guys,
Very much appreciate your help.

Aaron.

Tags (2)
0 Karma
1 Solution

jonuwz
Influencer

Probably something like :

... | eval ip_port=dest_ip.";".dest_port
    | stats count as rule_ip_port_count by rule_name ip_port
    | eventstats sum(rule_ip_port_count) as rule_count by rule_name
    | rex field=ip_port (?<dest_ip>.*);(?<dest_port>.*) 
    | fields - ip_port

Edit - typo

View solution in original post

jonuwz
Influencer

Probably something like :

... | eval ip_port=dest_ip.";".dest_port
    | stats count as rule_ip_port_count by rule_name ip_port
    | eventstats sum(rule_ip_port_count) as rule_count by rule_name
    | rex field=ip_port (?<dest_ip>.*);(?<dest_port>.*) 
    | fields - ip_port

Edit - typo

jonuwz
Influencer

good spot.

0 Karma

aaronnicoli
Path Finder

Mate, your the best!
Exactly what I am after, only thing I had to correct was in your first line...

dest_ip.";"dest_port

Needed to become:

dest_ip.";".dest_port

I assumed the . was to concat.

Cheers again,
Aaron.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...