I would like to use the following cmd in splunk and I am getting errors.
egrep "Failed password" auth.log | awk '{print $13}' | sort | uniq -c | sort -rn | less
Is this possible?
(cross-posted from forums)
try something along the lines of:
source=auth.log Failed password | rex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | stats count by src_ip | sort -count
this should produce a table of ip addresses and the count of the time they were in the logfile.
One caveat though, top will truncate the result set based on the limit= parameter, you would have to use limit=0 to get the same results.
The clause "stats count by src_ip | sort -count" can be replaced with "top src_ip". The difference is that the "top" command will also add a "percent" field to the results.