For example:
|stats count by src_ip
src_ip count
1.1.1.1 100
2.2.2.2 200
3.3.3.3 300
|stats count by dst_ip
dst_ip count
1.1.1.1 200
2.2.2.2 300
3.3.3.3 400
On these conditions, I wan to create the table
ip_addr count
1.1.1.1 300
2.2.2.2 500
3.3.3.3 700
How can I create the table?
Assuming both fields exist on each event, try this
.... | eval ip=src_ip.",".dst_ip | makemv ip delim="," | mvexpand ip | stats count by ip
Assuming both fields exist on each event, try this
.... | eval ip=src_ip.",".dst_ip | makemv ip delim="," | mvexpand ip | stats count by ip
I could do it!
Thanks a lot bro 🙂