topic Re: Need SPL query in Splunk Search

Need SPL query

SabariRajanT — Thu, 01 Jul 2021 15:42:52 GMT

Hi All,

I have a unique values like below in my splunk dashboard,

Email account: Anaoymzer

All the above email account display with mail address list with IP address and ananoymzer as yes and No.

we need to pull unique email account column as displayed above and Ananoymzer = yes in past 24 hours.

Required SPL Query for this.

Re: Need SPL query

kamlesh_vaghela — Thu, 01 Jul 2021 15:58:37 GMT

@SabariRajanT

Can you please try this?

YOUR_SEARCH | where Anaoymzer="Yes" | dedup Email_account

My Sample Search :

| makeresults | eval _raw="Email account,Anaoymzer sab@gmail.com ,No tr@gmail.com,Yes rt@mail.com,No sab@gmail.com,Yes sab@gmail.com,Yes sab@gmail.com,Yes"| multikv forceheader=1 | table Email_account,Anaoymzer | rename comment as "Upto Now is sample data only" | where Anaoymzer="Yes" | dedup Email_account

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Need SPL query

gcusello — Thu, 01 Jul 2021 15:59:53 GMT

Hi @SabariRajanT,

if I correctly understood, you want only one value for each email and the anomynizer value is yes when there are both yes and not, is it correct?

if this is your need ,please ,try something like this:

your_search | stats dc(anonymizer) AS dc_anonymizer values(anonymizer) AS anonymizer BY email | eval anonymizer=if(dc_anonymizer=2,"yes",anonymizer) | table mail anonymizer

Ciao.

Giuseppe