- Splunk Answers
- :
- Using Splunk
- :
- Splunk Dev
- :
- Re: What would be the right approach to rerurn res...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What would be the right approach to rerurn results when a unique field value is seen with several if another field value?
For example
index=active_directory | eventstats count by useraccount | search count=1
The above returning events for a unique field value of useraccount. What I am looking for is events with a unique user account grouped with several of another field value. Have tried transaction command to no avail.
Pointing in the right direction is greatly appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=active_directory | stats values(process_name) count by user
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
grouped with several of another field value.
What's the fields?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Field of process_name
So one useraccount with many processes accessed , process_name being many different values
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is this closer to what you are looking for?
index=active_directory | stats values(process_name) by user
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes this works!
I just added a count
| stats count values(process_name) by user
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great, I'll post it as an answer so you can accept it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After testing it out, it is returning on a single process_name value given the threshold.
So instead of returning results where one user is seen with many process_name values it groups a user with any process_name value
Hopefully this came across clearly
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
something like this?
index=active_directory | stats distinct_count(user) as distinct_count by host | where distinct_count=1
Detecting Remote Code Executions With the Splunk Threat Research Team
Observability | Use Synthetic Monitoring for Website Metadata Verification
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
