How to write a query to find event count of source ip greater than 10000 in 30mins?
How to write a query to find event count of source ip greater than 10000 in 30mins? Aggregate view should display source Ip and corresponding destination IP's(with count). I have written query to fetch the source Ip(event count more than 10000) but could not able to display corresponding destination IP's with count. Threshold 10000 is greater than overall count for the source ip
-
Hi Allwin,
How's this going? Can you share a sample log file or some of the output? Using Apache logs with source IP and destination URL as an example, are you looking for something like this?
_sourceCategory=Labs/Apache/Access
| parse "] \"GET * HTTP" as url
| parse "* - - " as src
| count by src, url | where _count > 10000Michael
Please sign in to leave a comment.
Comments
1 comment