Splunk Search

group ip by count

janfabo
Explorer

Hello, I'm trying to write search, that will show me denied ip's sorted by it's count, like this:
host="1.1.1.1" denied | stats sum(count) as count by src_ip | graph, but this only shows me number of matching events and no stats. I'd like to visualize result in form of either table or chart. Could you please advise me how to do that? Thanx in advance.

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

First of all, src_ip must actually be a field that exists in the data and is extracted by Splunk.

If it is, then

... "denied" | top src_ip

or

... "denied" | stats count by src_ip | sort - count

janfabo
Explorer

Great, it works! The field didn't exists, after adding extraction rule everything works. thanks.

0 Karma

janfabo
Explorer

well, this shows 0 results even if there are 10 matching events (1). See the picture here. When I click 2 at the picture there is 10 log records. Maybe I have something misconfigured...

0 Karma

jonuwz
Influencer

Can you post a sample of the data?

0 Karma

jonuwz
Influencer

Something like this :

host="20.20.20.5" denied | chart count by src_ip 

?

janfabo
Explorer

well I did it through CLI: # ./splunk search "host=\"20.20.20.5\" denied" | awk '{ print $14 }' | sort | uniq -c , but how to do it through webinterface?

0 Karma