Splunk Search

Unique IP count

jdhavo
New Member

It seems like something that has been answered before but i have been unable to find the answer.
Is it possible to run a query that provides unique IP source addresses when searching for a particular string?
I've tried this however i'm not having any success:

splunk_server=* index="mysiteindes" host=NXR4RIET313 SCRAPY | stats dc(src_ip)

Would be particularly helpful if a portion of the IP (Host, Network) could be queried.

Tags (2)
0 Karma

DavidHourani
Super Champion

Hi @jdhavo,

The stats command dc gives the distinct count as shown here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Stats

If you want the list of unique IP addresses you can use the values stats command. And if you want you can have both :

splunk_server=* index="mysiteindes" host=NXR4RIET313 SCRAPY | stats values(src_ip) as src_ip dc(src_ip) as distinctCountIP 

Note that values puts everything in the same block so you can use mvexpand command to split the results out into multiple lines.

In either case make sure the src_ip field exists or you won't be able to run anything 🙂

Cheers,
David

0 Karma

FrankVl
Ultra Champion

The query you have right now simply returns the number of unique IP addresses. If you want the actual list of unique addresses, try this:

splunk_server=* index="mysiteindes" host=NXR4RIET313 SCRAPY | stats values(src_ip)

Or:

splunk_server=* index="mysiteindes" host=NXR4RIET313 SCRAPY | stats count by src_ip

To also get the number of events for each unique address.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Does your Splunk data contains IP address in them?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...