From Splunk to ELK: how to perform statistic searches?

Elastic Stack Elasticsearch
1

Hi,

I spent last few years with Splunk and now I’m an ELK user. I’d like to know if there is a way to perform a statistical search in ELK.

Let’s say, I have some firewall logs and I’d like to use it to detect a port scan behaviour. Here’s the query I’ll use in Splunk:

index=my_firewall_index

| stats dc(dest_port) as unequal_dest_port by source_ip

| where unequal_dest_port > 50

Could you please provide an ELK equivalent for this search?

Thanks.

2

Welcome to our community! :smiley:

You'd build a visualisation, aggregating on the source_ip field and then running a count metric on the dest_port field. Then add a filter for dest_port > 50

3

Sounds not that difficult :slight_smile: I'll try it.
Thanks for the help!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.