Splunk Search

Trouble displaying multiple stats

Path Finder

I am doing a search on our firewall. I am looking to see who is making the most requests on different ports, and also list the total number of requests. I am also interested in what country they are coming from.

I am having trouble with formating the output to show all that I am looking for.

<Basic_Search> | stats dc(dest_port) by src_ip

Returns the number of distince ports that are being hit by each source IP.

<Basic_Search> | stats count by src_ip
| iplocation src_ip
| sort limit=5 -count

Returns the IPs sending the most traffic, where they are.

But, if I try to output a table with something like:

| stats dc(dest_port) by src_ip
| stats count by src_ip
| iplocation src_ip
| sort limit=5 -count

The dc for destination port disappears. (Or is not passed.)

Any ideas on how to get a list of the top X IP's by volume, and also have the IP Location and number of different ports listed?

Tags (1)
0 Karma


You can have multiple aggregate verbs in a single stats command...

 | stats count as theCount, dc(dest_port) as thePorts by src_ip
 | iplocation src_ip
 | sort limit=5 - theCount
0 Karma

Super Champion

Your second stats command basically erases the first. You need to carry over the values from each stats command you do to keep the values. Try something like this:

 | eventstats dc(dest_port) as dcDestPort by src_ip
 | stats max(dcDestPort) as destPorts count by src_ip
 | iplocation src_ip
 | sort limit=5 -count
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...