Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About jhamot23
jhamot23
Engager
Member since:
09-29-2020
07-19-2022
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 09-29-2020 |
Activity Feed
- Posted Re: How to achieve top 10 src_ip's along with top 10 urls for each src_ip? on Splunk Search. 07-18-2022 11:30 AM
- Posted Re: How to achieve top 10 src_ip's along with top 10 urls for each src_ip? on Splunk Search. 07-18-2022 11:30 AM
- Posted How to achieve top 10 src_ip's along with top 10 urls for each src_ip? on Splunk Search. 07-18-2022 11:03 AM
- Posted Re: How to clean up query for top 10 urls of top users? on Splunk Search. 07-18-2022 10:28 AM
- Posted Re: How to trigger alert for when a host reaches out to a filepath on Alerting. 10-07-2020 09:12 AM
- Posted How to trigger alert for when a host reaches out to a filepath on Alerting. 09-29-2020 08:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
07-18-2022
11:30 AM
This is what I was looking for! Thank you!
... View more
07-18-2022
11:30 AM
Appreciate the insights. Yes I just started playing around with the top command, and this did help get me in the neighborhood but was looking for a more cleaner list of just top 10 src_ips by top 10 urls visited. Looks like the suggestion below got me the list I was looking for. Thank you!
... View more
07-18-2022
11:03 AM
I'm trying to run a query to figure out the top 10 src_ip's along with their top 10 urls visited. When I try the below query it's giving me every src_ip instead of just the top 10.
Any suggestions on how to limit the search for just the top 10 src_ip by top 10 url?
I've been running something like this:
index=firewall | stats count by src_ip, url | sort 0 src_ip -count | streamstats count as standings by src_ip | where standings < 11 | eventstats sum(count) as total by category | sort 0 -total src_ip -count
... View more
07-18-2022
10:28 AM
I'm trying to run a similar query, but using src_ip instead of users. When I try the above queries it's giving me every src_ip instead of just the top 10. Any suggestions on how to limit the search for just the top src_ip by top url? I've been running something like this: index=firewall | stats count by src_ip, url | sort 0 src_ip -count | streamstats count as standings by src_ip | where standings < 11 | eventstats sum(count) as total by category | sort 0 -total src_ip -count
... View more
10-07-2020
09:12 AM
This is just for Mac OS data, I do have a datasource that reports file accesses and a list of allowed file accesses. Just need some help getting the query right for alerting.
... View more
09-29-2020
08:59 AM
I'm looking to create a custom alert for when a host that should only be accessing a certain filepath, then reaches out to a filepath that it should not be accessing... So for example a host that should only be accessing C:\Documents\Newsletters\Summer2018 then accesses a seperate filepath of :\Projects\apilibrary, how can I create an alert for when the host accesses a filepath other than the one it should only be accessing?
... View more
Labels
- Labels:
-
alert condition
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-19-2022
07:29 PM
|
