Summarize IDs from several log entries

friziqz — Fri, 27 Mar 2020 12:37:40 GMT

Hey,

i have a Firewall Log and want to count the sending/receiving domains.
My problem is that there is for one email three or more log entrys.
Each message has a uniqe ID, which is available in every associated log entry.
Is it possible to merge these, so that i dont count an email twice or more.

Thank you 🙂

My current search looks like this:

| rex field=_raw "to=<(?[\w\d\.\-]+\@(?[\d\w\.\-]+)\>)" 
| stats count(domain2) AS Anzahl by domain2 
| rename domain2 AS "Domain Outgoing Anzahl" 
| sort - Anzahl 
| head 50

Re: Summarize IDs from several log entries

richgalloway — Fri, 27 Mar 2020 12:50:02 GMT

Try this query.

| rex field=_raw "to=<(?[\w\d\.\-]+\@(?[\d\w\.\-]+)\>)" 
| dedup uniqueID
| stats count(domain2) AS Anzahl by domain2 
| rename domain2 AS "Domain Outgoing Anzahl" 
| sort 50 - Anzahl

topic Summarize IDs from several log entries in Splunk Search

Summarize IDs from several log entries

Re: Summarize IDs from several log entries