Splunk Search

Unique Port Count Per IP

ThisIsTom
New Member

I'm trying to find the number of unique ports accessed by IP's, by count. i.e. IP 8.8.8.8 connected to 5 unique ports. As of right now I am able to see the unique ports connected to by the IP address with the below command.

sourcetype="source_traffic" | stats values(src_port) by dst_ip

Is there a way to count those unique ports and display only that number? I have also tried:

sourcetype="source_traffic" dst_ip="x.x.x.x" | stats count values(src_port) by dst_ip

This one appears to the show a higher count than displayed port numbers.

TIA for any help!

Tags (4)
0 Karma
1 Solution

theouhuios
Motivator

I guess you can do something like this

stats dc(src_port) by dst_ip

View solution in original post

0 Karma

theouhuios
Motivator

I guess you can do something like this

stats dc(src_port) by dst_ip
0 Karma

lbogle
Contributor

I'm actually looking for something similar however not to find the count of ports but a listing of the actual ports that IP is using. So like a top 10 src_ip and then the top 3 ports that each of the src_ip's is using. Does that make sense?

0 Karma

ThisIsTom
New Member

Appreciate the quick response! It was on the money.

sourcetype="source_traffic" | stats dc(src_port) by dst_ip

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...