Splunk Search

Using stats dc with stats list and count

Motivator

I have the following search looking for external hosts that are trying to brute force multiple WordPress or Drupal sites:

index=foo sourcetype="f5:bigip:asm:syslog" action!=blocked uri="/*login.php" OR uri="/*admin/" OR  uri="*user\/login" uri!="*revslider*" action!=blocked 
| stats count by src uri
| sort -count
| stats list(uri) as URI, list(count) as count, sum(count) as Total by src 
| sort -Total
| head 10

Output is as follows:

alt text

How can I utilize stats dc to return only those results that have >5 URIs?

Thx

0 Karma
1 Solution

Champion

Hi @jwalzerpitt

Please try

| stats dc(uri) as distinct_uri, values(uri) as URI, values(count) as count, sum(count) as Total by src | where distinct_uri > 5

View solution in original post

Champion

Hi @jwalzerpitt

Please try

| stats dc(uri) as distinct_uri, values(uri) as URI, values(count) as count, sum(count) as Total by src | where distinct_uri > 5

View solution in original post

Motivator

Thx as that worked perfectly!

0 Karma

Champion

welcome 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!