Splunk Search

Trouble displaying multiple stats

stakor
Path Finder

I am doing a search on our firewall. I am looking to see who is making the most requests on different ports, and also list the total number of requests. I am also interested in what country they are coming from.

I am having trouble with formating the output to show all that I am looking for.

<Basic_Search> | stats dc(dest_port) by src_ip

Returns the number of distince ports that are being hit by each source IP.

<Basic_Search> | stats count by src_ip
| iplocation src_ip
| sort limit=5 -count

Returns the IPs sending the most traffic, where they are.

But, if I try to output a table with something like:

<Basic_Search>
| stats dc(dest_port) by src_ip
| stats count by src_ip
| iplocation src_ip
| sort limit=5 -count

The dc for destination port disappears. (Or is not passed.)

Any ideas on how to get a list of the top X IP's by volume, and also have the IP Location and number of different ports listed?

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

You can have multiple aggregate verbs in a single stats command...

 <Basic_Search>
 | stats count as theCount, dc(dest_port) as thePorts by src_ip
 | iplocation src_ip
 | sort limit=5 - theCount
0 Karma

cmerriman
Super Champion

Your second stats command basically erases the first. You need to carry over the values from each stats command you do to keep the values. Try something like this:

<Basic_Search>
 | eventstats dc(dest_port) as dcDestPort by src_ip
 | stats max(dcDestPort) as destPorts count by src_ip
 | iplocation src_ip
 | sort limit=5 -count
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...