topic Re: getting duplicate fields from splunk result in Getting Data In

getting duplicate fields from splunk result

ektasiwani — Tue, 29 Sep 2020 07:09:03 GMT

Hi,

My requirement is to find is same pair of source and ip addresses are being used.
for example if this is my table

src_ip ,dest_ip,action
192.168.10.2,192.168.10.3,block
192.168.10.21,192.168.10.13,block
192.168.10.2,192.168.10.3,allow

i want as a result:
192.168.10.2,192.168.10.3,allow
192.168.10.2,192.168.10.3,block

How to achieve this?

Thanks

Re: getting duplicate fields from splunk result

tom_frotscher — Mon, 31 Aug 2015 09:38:01 GMT

Hi,

you can use the dedup command:

... | dedup src_ip dest_ip action

or you can use stats:

... | stats count by src_ip dest_ip action | fields -count

If possible, you should use stats, it should be faster than dedup. But without further ado, after a stats you only have the fields left, that you used in your by clause.

Greetings

Tom

Re: getting duplicate fields from splunk result

chanmi2 — Tue, 01 Sep 2015 09:07:09 GMT

you may try this:

... | eventstats count by src_ip ,dest_ip | where count = 2