Splunk Search

how to exclucde number of values from search

New Member

sourcetype="sourcetraffic" | stats values(destport) by dst_ip

Hi I am lookin for result of IP which have more than one port associate with it.
I would like to exclude the results one IP with one port.
e.g. current result

destip destport
10.10.10.01 389
10.10.10.2 162
10.10.10.3 389
............ 143
............ 162
10.10.10.4 389
........... 162
........... 443.

I want result which shows only IP with more than 2 dest_port

destip destport
10.10.10.3 389
............ 143
............ 162
10.10.10.4 389
........... 162
........... 443

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Do it like this

sourcetype="source_traffic" 
| stats values(dest_port) as Ports by dst_ip
| where mvcount(Ports)>1

View solution in original post

0 Karma

New Member

Yes it is working ..much appreciated. thank you!!!

0 Karma

SplunkTrust
SplunkTrust

Do it like this

sourcetype="source_traffic" 
| stats values(dest_port) as Ports by dst_ip
| where mvcount(Ports)>1

View solution in original post

0 Karma