Splunk Search

Count unique IP's in 1 minute span over 1 hour or more.

jevenson
Path Finder

This may be confusing, so I'll try to explain it as best as I can. I've got a search that looks for servers that get marked down by the load balancer in a 1 minute time frame, and de-duplicates the IP's. I am then alerted if the number of IP's is greater than a certain number. My search is as follows:

sourcetype=syslog service down | dedup HostIP

This search works great over the realtime 1 minute rolling window. What I'd like to do though is search back historically and see when there were 3 or more unique HostIPs in a 1 minute window.

I tried searching with something like this:

sourcetype=syslog service down | bucket _time span=1m | stats count by _time

And that sort of works, but I can't get the dedup to work for each 1 minute interval, instead it dedup's the entire time range, which isn't what I want.

Any ideas?

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Couldn't you just use dc instead of count in your stats command?

sourcetype=syslog service down | bucket _time span=1m | stats dc(HostIP) by _time 

View solution in original post

Ayn
Legend

Couldn't you just use dc instead of count in your stats command?

sourcetype=syslog service down | bucket _time span=1m | stats dc(HostIP) by _time 
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...