Splunk Search

Top 10 ip addresses denied over last 7 days

ryanmims
Explorer

Trying to write a search that will show top 10 "repeat" offenders over last 7 days. I'm guessing an eval(if) statement but not really sure. Only want to see repeat srcip's, not IP's that only get denied during 1 day.

Any help would be greatly appreciated.
Thanx

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this. It will give you the top 10 repeat offenders, but depending on your data they may all be on the same day.

'... | stats count(_time) AS Occurs by src_ip | where Occurs > 6 | top limit=10 Occurs,src_ip | ...'

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

ryanmims
Explorer

This one works. Tweaking...Thanx Martin

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How 'bout this then?

index=yourIndex sourcetype=yourSourceType earliest=-7d@d | eventstats dc(date_mday) as days by src_ip | where days > 1 | top limit=10 src_ip

richgalloway
SplunkTrust
SplunkTrust

Try this. It will give you the top 10 repeat offenders, but depending on your data they may all be on the same day.

'... | stats count(_time) AS Occurs by src_ip | where Occurs > 6 | top limit=10 Occurs,src_ip | ...'

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think it will. See martin_mueller's comment.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ryanmims
Explorer

Would (date_mday) work better than _time to make sure it is only counting the days rather than time entries?

0 Karma

ryanmims
Explorer

No, it works but need only IP
s with date returned if they have been denied more than 1 day over search period

0 Karma

somesoni2
SplunkTrust
SplunkTrust

something like this will work?

index=yourIndex sourcetype=yourSourceType earliest=-7d@d | top limit=10 src_ip

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...