Using stats dc with stats list and count

[jwalzerpitt]

I have the following search looking for external hosts that are trying to brute force multiple WordPress or Drupal sites:

index=foo sourcetype="f5:bigip:asm:syslog" action!=blocked uri="/*login.php" OR uri="/*admin/" OR  uri="*user\/login" uri!="*revslider*" action!=blocked 
| stats count by src uri
| sort -count
| stats list(uri) as URI, list(count) as count, sum(count) as Total by src 
| sort -Total
| head 10

Output is as follows:

How can I utilize stats dc to return only those results that have >5 URIs?

Thx

[vnravikumar · Accepted solution]

Hi @jwalzerpitt

Please try

| stats dc(uri) as distinct_uri, values(uri) as URI, values(count) as count, sum(count) as Total by src | where distinct_uri > 5

[jwalzerpitt]

Thx as that worked perfectly!

[vnravikumar]

welcome 🙂