Splunk Search

help with search request

Communicator

Hello.

Just starting to deal with complex query to splank, there is now a need to make a request that would be deduced from the log ip addresses that connect more than two users.

Is it possible?

Thank you.

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can do this:

sourcetype=your_sourcetype | eventstats dc(user) as dc_user by clientip | where dc_user > 2

View solution in original post

SplunkTrust
SplunkTrust

You can do this:

sourcetype=your_sourcetype | eventstats dc(user) as dc_user by clientip | where dc_user > 2

View solution in original post

Communicator

Perfect!
Exactly, what was needed. Now he is going to read the documentation and learn search.

Thank you!

0 Karma

Communicator

hello, example:

*xxx.xxx.xxx.xxx* - *user@domain.ru* [13/Jul/2014:04:02:27 +0400] "GET /src/?_task=mail&_action=check-recent&_mbox=INBOX&_list=1&_quota=1&_remote=1&_unlock=0&_=1405209744809 HTTP/1.1" 200 260

I need to display ip addresses (name - clientip) in log which was at over 2-3 user email (name in log - user)

0 Karma

Influencer

Yes it is possible. If you could provide little more details like sample log events, we can help you to write the search.

0 Karma