Splunk Search

group by srcIP and total count dstIP

happy035
Explorer

Hello, I'm trying to compose search, that will show me srcIP, dstIP, count by dstIP like this:

srcIP       dstIP    count
1.1.1.1     2.2.2.2    15
            2.2.2.3     10
            2.3.4.3     10    
5.5.5.5     6.6.6.6     8
            7.7.7.7      8

I used like this status="failure" | stats count(dst) by src, dst, but I was unable to get distinct value of srcIP. Could you please advise me how to do that? Thanx in advance.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

There are a couple of ways to do this. Easiest:

status=failure | stats count by src, dst

It repeats the source IP on each line, though. This may also work:

status=failure 
| stats count by src, dst
| stats list(dst) as dstIP list(count) as count by src
| rename src as srcIP

This may look more like what you want. However, this version will not export in a useful way.

View solution in original post

0 Karma

lguinn2
Legend

There are a couple of ways to do this. Easiest:

status=failure | stats count by src, dst

It repeats the source IP on each line, though. This may also work:

status=failure 
| stats count by src, dst
| stats list(dst) as dstIP list(count) as count by src
| rename src as srcIP

This may look more like what you want. However, this version will not export in a useful way.

0 Karma

happy035
Explorer

Appreciate for your perfect answer.
It works and much helpful to me.
Nice day.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...