Splunk Search

How to search top 5 IPs with highest distinct count emails per day?

niboucher
Explorer

Hello,

In each line of the logs ,there is an email, an IP address and a timestamp.

I'd like to calculate for each day the top 1 (or top 5 or top 10) IPs which have the biggest number of distinct emails.

I'm using this

| bin span=1d _time
| stats dc(email) by ip,_time

but this doesn't do the trick since it prints a line for each IP and each day and I don't know to get only the top 5 dc(email) per IP

I'd like the result to look like this

_time        dc(email)    ip

2014-07-28   50           10.1.1.1
             30           1.1.1.2
             20           1.1.1.3
             10           1.1.1.4
             10           1.1.1.4
2014-07-29   120          10.9.1.1
             85           25.1.1.2
             45           34.1.1.3
             35           26.1.1.4
             15           42.1.1.4

Do you guys know how to do this?

Tags (4)

somesoni2
SplunkTrust
SplunkTrust

Another way of achieving the same

your base search | bin span=1d _time | stats dc(email) as dc by ip,_time | sort _time,dc | streamstats count by _time | where count < 6
0 Karma

somesoni2
SplunkTrust
SplunkTrust

It indeed should be <6. Thanks for pointing it out. I guess I'm in mood for early Friday..

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Wouldn't that be where count < 6?

0 Karma

aelliott
Motivator

Try something like this:

|bucket _time span=1d | eventstats dc(email) by ip | top limit=5 dc(email),ip by _time |sort -_time, -dc(email)

aelliott
Motivator

Updated the answer, should be good now.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...