Splunk Search

What is the best way to search, sort and group data of multiple wired and wireless networks by IP?

Engager

Hi, I want to create a report that will graph the traffic from wireless networks and wired networks so that I can see which networks have the most usage. The graph will have two fields - wireless and wired. There are multiple subnets for each network type. There are fewer wireless networks than wired so searching for wireless networks and making everything else "other" is ok.

I've looked at eval, case, if, where, and lookups but I am unsure of the best way to search, sort, and group the data. Any help would be very much appreciated.

Sample data:

Wireless networks - 10.1.1.0 /24, 10.10.10.0/24, 10.20.20.0/24
Wired networks - 10.2.2.0/24, 10.100.100.0/24, 10.200.200.0/24

1 Solution

SplunkTrust
SplunkTrust

You can try something like this

your base search | eval type=if(cidrmatch("10.1.1.0 /24",yourIPfield) OR cidrmatch("10.10.10.0/24",yourIPfield) OR ..other values....,"Wireless","Wired" | stats count by type

View solution in original post

SplunkTrust
SplunkTrust

You can try something like this

your base search | eval type=if(cidrmatch("10.1.1.0 /24",yourIPfield) OR cidrmatch("10.10.10.0/24",yourIPfield) OR ..other values....,"Wireless","Wired" | stats count by type

View solution in original post

Engager

Thanks! This worked!

0 Karma