Splunk Search

How do I filter out event based on a value that presents only in specific event?

frank_zhang
Path Finder

Hi,

I have a search produces the following 4 events, I'd like to filter all events for an IP if any event for that IP has I2A=1, i.e. filter out both events for 1.1.1.1 and the final results should only keep the two events for 2.2.2.2

| IP      | A2I | I2A |
| 1.1.1.1 | 1   | 0   |
| 1.1.1.1 | 0   | 1   |
| 2.2.2.2 | 0   | 0   |
| 2.2.2.2 | 1   | 0   |

Thanks.

Tags (2)
0 Karma
1 Solution

gfuente
Motivator

Hello

You can use the eventstats command to get this

yourbasesearch | eventstats max(I2A) as MAXI2A by IP | search MAXI2A="0" | ...

Regards

View solution in original post

gfuente
Motivator

Hello

You can use the eventstats command to get this

yourbasesearch | eventstats max(I2A) as MAXI2A by IP | search MAXI2A="0" | ...

Regards

frank_zhang
Path Finder

Thanks for your solution.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...