Splunk Search

Showing filed only once per unique occurrence

gleandro
Engager

Hello,

I am having problems with Splunk queries were a single unique instance of a field is repeated over other field instances. For example, I imported a csv with extracted fields from a windows security event log for failed logon events. The problem is for example if the account of the failed login event is Administrator coming from multiple source IPs, "Administrator shows for each unique IP. Were instead I want to show only one entry of Administrator for each failed source IP. Similarly, I have firewall logs with a similar circumstance. For traffic originating from IP 192.168.1.10, over different ports, to a single destination IP. My current query returns the single destination IP for each different service port. Instead for single source, destination, I want to see the list of service ports for that combination. However the destination IP will have an entry for each different service port. I am using the following query:

index="fw_traffic" Rule="Internet" | stats list(Application) as App, list("Destination address") as dst_ip by "Source address" | sort dst_ip

host = win2008 EventID=4625 | stats count, values(IP) as IP by Account, Workstation | table Account, IP, Workstation | sort Account

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

Does this give you what you are after?

host = win2008 EventID=4625 | stats values(Workstation) as Workstation values(IP) as IP by Account | sort Account

Similarly for your firewall traffic:

index="fw_traffic" Rule="Internet" | stats values(Application) as App  by "Source address" "Destination address"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...