Splunk Search

Unique Port Count Per IP

ThisIsTom
New Member

I'm trying to find the number of unique ports accessed by IP's, by count. i.e. IP 8.8.8.8 connected to 5 unique ports. As of right now I am able to see the unique ports connected to by the IP address with the below command.

sourcetype="source_traffic" | stats values(src_port) by dst_ip

Is there a way to count those unique ports and display only that number? I have also tried:

sourcetype="source_traffic" dst_ip="x.x.x.x" | stats count values(src_port) by dst_ip

This one appears to the show a higher count than displayed port numbers.

TIA for any help!

Tags (4)
0 Karma
1 Solution

theouhuios
Motivator

I guess you can do something like this

stats dc(src_port) by dst_ip

View solution in original post

0 Karma

theouhuios
Motivator

I guess you can do something like this

stats dc(src_port) by dst_ip
0 Karma

lbogle
Contributor

I'm actually looking for something similar however not to find the count of ports but a listing of the actual ports that IP is using. So like a top 10 src_ip and then the top 3 ports that each of the src_ip's is using. Does that make sense?

0 Karma

ThisIsTom
New Member

Appreciate the quick response! It was on the money.

sourcetype="source_traffic" | stats dc(src_port) by dst_ip

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...