group ip by count

[janfabo]

Hello, I'm trying to write search, that will show me denied ip's sorted by it's count, like this:
host="1.1.1.1" denied | stats sum(count) as count by src_ip | graph, but this only shows me number of matching events and no stats. I'd like to visualize result in form of either table or chart. Could you please advise me how to do that? Thanx in advance.

[gkanapathy]

First of all, src_ip must actually be a field that exists in the data and is extracted by Splunk.

If it is, then

... "denied" | top src_ip

or

... "denied" | stats count by src_ip | sort - count

[janfabo]

Great, it works! The field didn't exists, after adding extraction rule everything works. thanks.

[janfabo]

well, this shows 0 results even if there are 10 matching events (1). See the picture here. When I click 2 at the picture there is 10 log records. Maybe I have something misconfigured...

[jonuwz]

Can you post a sample of the data?

[jonuwz]

Something like this :

host="20.20.20.5" denied | chart count by src_ip 

?

[janfabo]

well I did it through CLI: # ./splunk search "host=\"20.20.20.5\" denied" | awk '{ print $14 }' | sort | uniq -c , but how to do it through webinterface?