topic Re: Group repeating values of a field in Splunk Search

Group repeating values of a field

jedatt01 — Tue, 24 Sep 2013 23:28:11 GMT

I have a csv data source with example values as follows

MAC_ID, SSID
AAAA.AAAA.AAAA, TEST
BBBB.BBBB.BBBB, TEST
CCCC.CCCC.CCCC, TEST2
AAAA.AAAA.AAAA, TEST2
BBBB.BBBB.BBBB, TEST3

I want to be able to display a table that shows repeating values of MAC_ID like below
AAAA.AAAA.AAAA, TEST, TEST2
BBBB.BBBB.BBBB, TEST, TEST3

please help!

Re: Group repeating values of a field

lukejadamec — Tue, 24 Sep 2013 23:42:07 GMT

I don't think you can do that on a large scale. If the MAC_IDs and SSID's were known, then you could create a look up table matrix.

What you're asking for is changing the SSID field into a new field based on the SSID.

This would be easy with a table, but it would be vertical, not horizontal:

search | table MAC_ID,SSID | sort -MAC_ID

Re: Group repeating values of a field

adityapavan18 — Wed, 25 Sep 2013 11:16:51 GMT

Try something like this

|inputlookup something.csv | stats count values(SSID) by MACID | where count > 1

This will show you the MAC ID having repetitive values.

Re: Group repeating values of a field

sowings — Wed, 25 Sep 2013 13:27:24 GMT

Note that values() normalizes the list, and sorts them, while list() would give you each and every occurrence, in the order in which it appears in the log. In this case, values is probably what you want, but list can have its utility, too.

Re: Group repeating values of a field

jedatt01 — Wed, 25 Sep 2013 15:09:09 GMT

Thanks, this got me far enough that it worked

Re: Group repeating values of a field

jedatt01 — Wed, 25 Sep 2013 15:09:13 GMT

Same with this one, worked for me as well