Splunk Search

Trying to search a connections log, top 10 hosts sending the most traffic, doesn't seem to be working.

howardsamuels
New Member

Trying to search a connections log, top 10 hosts sending the most traffic, need some help, thanks.

Tags (1)
0 Karma

DEAD_BEEF
Builder
index=your_index | stats count by host sum(bytes_out) AS "Bytes Out" | sort -count limit=10
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@howardsamuels - The general answer to this type of question is

1) Find a single record of the type you want
2) craft a stats query to add it up the way you want it.

However, @niketnilay has provided three other viable methods, depending on what you are trying to achieve and what information is on your system.

The first thing to do is to specify what, exactly, you want to know.

0 Karma

niketn
Legend

@howardsamuels, for the community to assist you, you definitely need to add more details like what is the current search you have tried? What does your data look like in connections log? What does most traffic refer to (more no of events or more amount of data based on size)?

If your host ingests data to Splunk index, can you use metadata, tstats or eventcount command to get the number of events per host?

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventcount
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...