Splunk Search

Excluding daily values in chart if less then 1

fatsug
Communicator

Hello community

I am trying to combine two different things and cannot figure out how. I am looking at a certain action and counting how many times this is observed per IP address and day. Then I’m plotting per IP by day to try to find recurring events based on IP address. I got this far:

<base-search> earliest="-7d@d" latest="@d"
| chart count over ip by date_wday

Which does exactly what is intended, tough the details are lost as there are a lot if single events per IP address. So, I’d like to filter out any IP address with only 1 event during the period (here one week).

This works fine for filtering:

| stats count as sum by ip
| search summa > 1

But then I loose the details needed for the chart part. I figured maybe I could use eval to filter out based on total count but could not put together anything which worked. Even when I tried to combine stats and eval I either failed or ended up with something which could not be presented graphically.

Any suggestions are more than appreciated

Best regards

// G

Labels (1)
0 Karma
1 Solution

JacekF
Path Finder

You can try:

| eventstats count by IP
| where count > 1

 

View solution in original post

JacekF
Path Finder

You can try:

| eventstats count by IP
| where count > 1

 

fatsug
Communicator

This was exactly what I was looking for, thank you very much!

// G

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

Perhaps you can do it with timechart and a where clause. Something like:

<base-search> earliest="-7d@d" latest="@d"
| timechart span=1d count as sum by ip where sum > 1

fatsug
Communicator

I could and your suggestions works so a big thank you! However, this gives number of hits per IP by day, I wanted to see number of hits per day by IP.

I started out with timechart though as I wanted a bargraph showing if any IP performed the same action on any two or more days in the past week. I guess you could "switch" the x-axis for timechart (?) though it just seemed more appropriate to use chart.

Again, thank you very much! I'll hang an to that combination for later use!

Best regards

// G

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...