Splunk Search

Using stats dc with stats list and count

jwalzerpitt
Influencer

I have the following search looking for external hosts that are trying to brute force multiple WordPress or Drupal sites:

index=foo sourcetype="f5:bigip:asm:syslog" action!=blocked uri="/*login.php" OR uri="/*admin/" OR  uri="*user\/login" uri!="*revslider*" action!=blocked 
| stats count by src uri
| sort -count
| stats list(uri) as URI, list(count) as count, sum(count) as Total by src 
| sort -Total
| head 10

Output is as follows:

alt text

How can I utilize stats dc to return only those results that have >5 URIs?

Thx

0 Karma
1 Solution

vnravikumar
Champion

Hi @jwalzerpitt

Please try

| stats dc(uri) as distinct_uri, values(uri) as URI, values(count) as count, sum(count) as Total by src | where distinct_uri > 5

View solution in original post

vnravikumar
Champion

Hi @jwalzerpitt

Please try

| stats dc(uri) as distinct_uri, values(uri) as URI, values(count) as count, sum(count) as Total by src | where distinct_uri > 5

jwalzerpitt
Influencer

Thx as that worked perfectly!

0 Karma

vnravikumar
Champion

welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...