Splunk Search

Trying to search a connections log, top 10 hosts sending the most traffic, doesn't seem to be working.

howardsamuels
New Member

Trying to search a connections log, top 10 hosts sending the most traffic, need some help, thanks.

Tags (1)
0 Karma

DEAD_BEEF
Builder
index=your_index | stats count by host sum(bytes_out) AS "Bytes Out" | sort -count limit=10
0 Karma

DalJeanis
Legend

@howardsamuels - The general answer to this type of question is

1) Find a single record of the type you want
2) craft a stats query to add it up the way you want it.

However, @niketnilay has provided three other viable methods, depending on what you are trying to achieve and what information is on your system.

The first thing to do is to specify what, exactly, you want to know.

0 Karma

niketn
Legend

@howardsamuels, for the community to assist you, you definitely need to add more details like what is the current search you have tried? What does your data look like in connections log? What does most traffic refer to (more no of events or more amount of data based on size)?

If your host ingests data to Splunk index, can you use metadata, tstats or eventcount command to get the number of events per host?

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventcount
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...