Splunk Search

group ip by count

janfabo
Explorer

Hello, I'm trying to write search, that will show me denied ip's sorted by it's count, like this:
host="1.1.1.1" denied | stats sum(count) as count by src_ip | graph, but this only shows me number of matching events and no stats. I'd like to visualize result in form of either table or chart. Could you please advise me how to do that? Thanx in advance.

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

First of all, src_ip must actually be a field that exists in the data and is extracted by Splunk.

If it is, then

... "denied" | top src_ip

or

... "denied" | stats count by src_ip | sort - count

janfabo
Explorer

Great, it works! The field didn't exists, after adding extraction rule everything works. thanks.

0 Karma

janfabo
Explorer

well, this shows 0 results even if there are 10 matching events (1). See the picture here. When I click 2 at the picture there is 10 log records. Maybe I have something misconfigured...

0 Karma

jonuwz
Influencer

Can you post a sample of the data?

0 Karma

jonuwz
Influencer

Something like this :

host="20.20.20.5" denied | chart count by src_ip 

?

janfabo
Explorer

well I did it through CLI: # ./splunk search "host=\"20.20.20.5\" denied" | awk '{ print $14 }' | sort | uniq -c , but how to do it through webinterface?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...