Splunk Search

group by srcIP and total count dstIP

happy035
Explorer

Hello, I'm trying to compose search, that will show me srcIP, dstIP, count by dstIP like this:

srcIP       dstIP    count
1.1.1.1     2.2.2.2    15
            2.2.2.3     10
            2.3.4.3     10    
5.5.5.5     6.6.6.6     8
            7.7.7.7      8

I used like this status="failure" | stats count(dst) by src, dst, but I was unable to get distinct value of srcIP. Could you please advise me how to do that? Thanx in advance.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

There are a couple of ways to do this. Easiest:

status=failure | stats count by src, dst

It repeats the source IP on each line, though. This may also work:

status=failure 
| stats count by src, dst
| stats list(dst) as dstIP list(count) as count by src
| rename src as srcIP

This may look more like what you want. However, this version will not export in a useful way.

View solution in original post

0 Karma

lguinn2
Legend

There are a couple of ways to do this. Easiest:

status=failure | stats count by src, dst

It repeats the source IP on each line, though. This may also work:

status=failure 
| stats count by src, dst
| stats list(dst) as dstIP list(count) as count by src
| rename src as srcIP

This may look more like what you want. However, this version will not export in a useful way.

0 Karma

happy035
Explorer

Appreciate for your perfect answer.
It works and much helpful to me.
Nice day.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...