For the following search, which command would further filter for only IP addresses present more than five times?
To filter for only IP addresses that appear more than five times in the search results for index=games, you can use a combination of the stats and where commands. The stats command counts the occurrences of each IP address and assigns the count to IP_count. The where command then filters the results to include only those IP addresses with a count greater than five.
Here is how the complete search would look:
index=games | stats count as IP_count by IP | where IP_count > 5
Splunk Docs: stats command
Splunk Docs: where command
Splunk Answers: Filtering results using stats and where commands
Stefany
9 days agoMaricela
11 days agoDoretha
16 days agoCathern
19 days agoDoretha
22 days agoRichelle
1 months agoTommy
15 days agoRaymon
19 days agoReena
1 months agoLeah
15 days agoGeraldo
20 days ago