Splunk Search

How to filter table results?

pierre_weg
Path Finder

Hi all!

I have a table as a search result:

date    Country cs_username
2018-06-12  Mexico  mendoza
2018-06-12  Mexico  mendoza
2018-06-12  Mexico  mendoza
2018-06-14  Mexico  mendoza
2018-06-20  Mexico  mendoza
2018-06-22  Mexico  mendoza
2018-06-25  Mexico  mendoza
2018-06-26  Mexico  mendoza
2018-06-26  Mexico  mendoza
2018-06-11  Netherlands xing
2018-06-11  United States   xing
2018-06-11  Nigeria xing
2018-06-13  United States   xing
2018-06-14  United States   xing
2018-06-15  United States   xing
2018-06-17  United States   xing
2018-06-22  Brazil  xing
2018-06-24  United States   xing
2018-06-25  Brazil  xing
2018-06-25  Brazil  xing
2018-06-25  United States   xing
2018-06-17  China   xue
2018-06-18  China   xue
2018-06-20  China   xue
2018-06-21  China   xue
2018-06-22  China   xue
2018-06-22  China   xue
2018-06-22  Brazil  xue

Note that to the same days I have the same user and 2 different Countries.

 2018-06-11 xing
    2018-06-25 xing
    2018-06-22  xue

This is the condition that I have interest.
I need to filter the table results to show just this:

 2018-06-11 Netherlands xing
    2018-06-11  United States   xing
    2018-06-11  Nigeria xing
    2018-06-25  Brazil  xing
    2018-06-25  Brazil  xing
    2018-06-25  United States   xing
    2018-06-22  China   xue
    2018-06-22  China   xue
    2018-06-22  Brazil  xue

Can anyone help me?

Thanks a lot!

0 Karma
1 Solution

FrankVl
Ultra Champion

Add this to your current search:

| eventstats dc(Country) as count by cs_username,date
| where count>1

View solution in original post

0 Karma

FrankVl
Ultra Champion

Add this to your current search:

| eventstats dc(Country) as count by cs_username,date
| where count>1
0 Karma

pierre_weg
Path Finder

Great!

Thank you FrankVI.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...