Splunk Search

Where following a dc(field)

stakor
Path Finder

I am looking at a firewall. I am trying to find only results where there are more than 20 distinct ports per source.

stats dc(port) by soure_ipaddr

I would like to use something like a where command. I was thinking of using a | where dc(port) > 20, but I get an error when I try that. What should I do to convert the results of the dc(port) to a value that where can use?

0 Karma
1 Solution

somesoni2
Revered Legend

You would need to use eventstats command to calculate dc(port) per source_ipaddr (adding another field without reducing/filtering) and then apply your where clause. like this

your base search 
| eventstats dc(port) as ports by soure_ipaddr
| where ports>20
| ...rest of the search 

View solution in original post

diegofavoretto
New Member

is it possible to apply on the filters the dc(account_id) for example ?

0 Karma

ddrillic
Ultra Champion

dc(port) as total .... | where total > 20

0 Karma

somesoni2
Revered Legend

You would need to use eventstats command to calculate dc(port) per source_ipaddr (adding another field without reducing/filtering) and then apply your where clause. like this

your base search 
| eventstats dc(port) as ports by soure_ipaddr
| where ports>20
| ...rest of the search 
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...