I did a 'splunk clean all' that seems to have worked for me. it will wipe all indexed data tho. best ... View more

not work, error occur as below: Error in 'stats' command: Repeated group-by field 'src'. ... View more

Note the issue with your raw data, "src-xlated ip" and "dst-xlated ip" are being extracted as "ip" because of the space. I used rex to pull them together. It would be better to change the log format. The next step would be to take this regex and add it to an extract and transform. assuming sent/received is in bytes, here is a good start for you: NetScreen | rex field=_raw "src-xlated ip=(?<src_ip>[\d+\.]+)" | rename src_ip AS "Source IP" | stats sum(sent) AS sentBytes sum(rcvd) AS rcvdBytes sum(eval(sent+rcvd)) AS total by "Source IP" ... View more

tmichels, A sample would go along way in terms of providing configuration details, but I can speak in generalities. Splunk can easily extract both src/dest IP and calculate unique (distinct) counts for these extracted fields. For example: | stats dc(src_ip) as unique_src_ips It is possible to add additional information based on an IP Address lookup. The integration depends on your data source. Is this information in a CSV? If yes, you can use a standard Splunk lookup. If it's accessible via an API or DB, you can use a scripted (custom) lookup ... View more