Hello, I'm trying to write search, that will show me denied ip's sorted by it's count, like this:
host="18.104.22.168" denied | stats sum(count) as count by src_ip | graph, but this only shows me number of matching events and no stats. I'd like to visualize result in form of either table or chart. Could you please advise me how to do that? Thanx in advance.
First of all,
src_ip must actually be a field that exists in the data and is extracted by Splunk.
If it is, then
... "denied" | top src_ip
... "denied" | stats count by src_ip | sort - count