How to remove all duplicates?

joango — Tue, 03 Jan 2023 02:05:42 GMT

Hi, i got this query

| tstats summariesonly=t allow_old_summaries=t dc(All_Traffic.dest_port) as num_dest_port dc(All_Traffic.dest_ip) as num_dest_ip from datamodel=Network_Traffic by All_Traffic.src_ip, All_Traffic.action | rename "All_Traffic.*" as "*" | where num_dest_port > 100 OR num_dest_ip > 100 AND num_dest_port > num_dest_ip | eval desv=num_dest_port / num_dest_ip | where desv > 1 AND action!="blocked"

And the result is:

My solution is half way done because it deletes most of them but not the ones that the src_ip is duplicate and the desv is diferent from one another (I don't know why). What I need is that all duplicates with the same ip are deleted.

This is what I have --> dedup src_ip | where desv > 1 AND action!="blocked" AND action!="teardown"

Thanks!

Re: Remove all dupicates

bowesmana — Mon, 02 Jan 2023 23:35:19 GMT

The result table you say is after the first search. What exactly is not working after you put in the dedup src_ip and the additional where constraint?

topic Re: Remove all dupicates in Getting Data In

How to remove all duplicates?

Re: Remove all dupicates