topic Re: How to exclude equal values at the same field? in Splunk Search

How to exclude equal values at the same field?

iabreu — Wed, 30 Jul 2014 19:18:35 GMT

Hello Splunkers,

I need a little help to exclude similar values at the same field in a search:

....| search ComputadorNome="PCSD-FA5-TI11" | eval CaminhoCompleto=Caminho+ArquivoInfectado | stats count by ComputadorNome, TextoResultado, UsuarioLogado, CaminhoCompleto, TipoScan

I need that all results that have similar values at field called "CaminhoCompleto" are not displayed at the result.

For example:

   Field 1------Caminhocompleto-------Field3----

1 123 ABC 098
2 324 ABC 987
3 234 CBA 678

In this case the line 1 and 2 would be excluded from the result, because the field Caminhocompleto have the value ABC appearing more than one time.

Best Regards,

Igor Abreu

Re: How to exclude equal values at the same field?

strive — Wed, 30 Jul 2014 20:11:05 GMT

Do you mean to say if the value for the field CaminhoCompleto is greater than 1 then you should exclude that event from the result

Re: How to exclude equal values at the same field?

iabreu — Wed, 30 Jul 2014 20:41:01 GMT

No, I said "1" just to exemplify, I mean that if the field "CaminhoCompleto" have any equal values, all events will not be showed. For exemple:

Field 1------Caminhocompleto-------Field3----
123 ABC 098
324 ABC 987
234 CBA 678

In this case the line 1 and 2 would be excluded from the result, because the field Caminhocompleto have the value ABC appearing more than one time.

Regards.

Re: How to exclude equal values at the same field?

somesoni2 — Wed, 30 Jul 2014 20:48:37 GMT

You want to exclude these entries (with more than 1 similar values) before the stats itself?

Re: How to exclude equal values at the same field?

somesoni2 — Wed, 30 Jul 2014 20:52:14 GMT

Try something like this

If you want to filter those results after stats.

| search ComputadorNome="PCSD-FA5-TI11" | eval CaminhoCompleto=Caminho+ArquivoInfectado | stats count by ComputadorNome, TextoResultado, UsuarioLogado, CaminhoCompleto, TipoScan | evenstats count as tempcount by CaminhoCompleto | where tempcount=1

Before stats

 | search ComputadorNome="PCSD-FA5-TI11" | eval CaminhoCompleto=Caminho+ArquivoInfectado | evenstats count as tempcount by CaminhoCompleto | where tempcount=1 | stats count by ComputadorNome, TextoResultado, UsuarioLogado, CaminhoCompleto, TipoScan

Re: How to exclude equal values at the same field?

iabreu — Wed, 30 Jul 2014 20:54:02 GMT

Yeah, exactly.

Re: How to exclude equal values at the same field?

somesoni2 — Wed, 30 Jul 2014 20:58:16 GMT

The 2nd query should help.