Splunk Search

Distinct count when grouped events meet certain criteria

monkey
Explorer

Hi there,

I can't for the life of me figure out how to do the following.

I'm analysing some standard web logs.

I want to be able to find out when any unique IP address accesses a particular URI path more than once a second.

The starting point I have for this is as follows:

uri_path=/foo | span=1s timechart dc(clientip)

This shows me when the distinct count of IP addresses accessing this URL per 1 second intervals BUT it includes all instances where the requests are made just once during this span. I only want a distinct count of the IP addresses that requested the URL more than once in the 1 second span.

Does anyone have any idea how to do this?

Many thanks.

Tags (1)

yannK
Splunk Employee
Splunk Employee

Add a filter condition after :

uri_path=/foo | span=1s timechart dc(clientip) AS distinct_ip | where distinct_ip >1

yannK
Splunk Employee
Splunk Employee

did it worked for you ?

0 Karma

yannK
Splunk Employee
Splunk Employee

ok so you want how many time EACH distinct ip connects in a 1 second windows. exclude all the ones that connected only one,
then count the number of those distinct ips per second.

uri_path=/foo 
| bucket _time span=1s 
| stats count by _time clientip 
| where count >1 
| timechart span=1s dc(clientip) as distinct_ip
0 Karma

monkey
Explorer

Thanks, yannK, but that doesn't quite achieve what I want: it charts data when more than one distinct client IP appears in one second. I only want to chart the count of distinct client IPs where the count of each distinct client IP is more than one.

192.168.1.1
192.168.1.1
192.168.2.2

I.e. if the above client IPs appear in one second, I want to chart "1" for that second (since 192.168.1.1 appears twice).

192.168.1.1
192.168.2.2
192.168.3.3

If the above appear in one second, I want to chart "0" for that second.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...