Splunk Search

Unique Port Count Per IP

ThisIsTom
New Member

I'm trying to find the number of unique ports accessed by IP's, by count. i.e. IP 8.8.8.8 connected to 5 unique ports. As of right now I am able to see the unique ports connected to by the IP address with the below command.

sourcetype="source_traffic" | stats values(src_port) by dst_ip

Is there a way to count those unique ports and display only that number? I have also tried:

sourcetype="source_traffic" dst_ip="x.x.x.x" | stats count values(src_port) by dst_ip

This one appears to the show a higher count than displayed port numbers.

TIA for any help!

Tags (4)
0 Karma
1 Solution

theouhuios
Motivator

I guess you can do something like this

stats dc(src_port) by dst_ip

View solution in original post

0 Karma

theouhuios
Motivator

I guess you can do something like this

stats dc(src_port) by dst_ip
0 Karma

lbogle
Contributor

I'm actually looking for something similar however not to find the count of ports but a listing of the actual ports that IP is using. So like a top 10 src_ip and then the top 3 ports that each of the src_ip's is using. Does that make sense?

0 Karma

ThisIsTom
New Member

Appreciate the quick response! It was on the money.

sourcetype="source_traffic" | stats dc(src_port) by dst_ip

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...