About adamski007

adamski007 · ‎10-05-2017

Thanks for all the help, really appreciated !

adamski007 · ‎10-05-2017

I think I got it but without the line : append [index=foo | stats dc(source_ip) as IpCount | eval URL = "All URLs"] because it just give me an error with that line... If I just give the following query : index=foo (src_ip=10.0.01 OR src_ip=10.0.0.2 OR src_ip=10.0.0.3) | stats dc(source_ip) as IpCount by URL | where IpCount = 3 This will give me ALL the destination URL which has been accessed by these 3 source IP.

adamski007 · ‎10-02-2017

yes, indeed, that's exactly what I want... any idea ?

adamski007 · ‎10-01-2017

ok seems that I was not clear enough in my question... Xisura almost made it... but in that query you showed me, it is actually all the url accessed by IP, and what I would want is the "intersect", the commun URL accessed by all these specific IP. Let's say that I got 2 IPs : - 10.1.1.1 - 10.2.2.2 and they respectively visit : A. 10.1.1.1 - bloomberg.com - foxnews.com B. 10.2.2.2 - bloomberg.com - cnn.com And so actually, I would want a query that return only URL [ bloomberg.com ] , because this URL has been visited by these 2 IPs. hoping it is clearer with the example. Thanks.

adamski007 · ‎09-30-2017

Hello, Hopefully, you will understand what I mean...It was not clear how I could formulate a search to find some documentation. I got an index, with a lot of fields [ f1, f2, f3, ... ]. Let's say that field f1 is the url from the proxy, and f2 is the source_ip of the request. What I would like is from a set of specific "source_ip", all the url that has been accessed by these "source_ip", and the url needs to be accessed by every single IP... Any idea how can I emplement the query in Splunk ? Thanks.

Posts	5
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎09-30-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Kind of inner join

Re: Kind of inner join

Re: Kind of inner join

Re: Kind of inner join

Re: Kind of inner join

Kind of inner join