Missing original value after using distinct query

michaelhoang — Mon, 22 Jul 2019 03:23:46 GMT

Hi,
I am having the following issue that need your help.
The scenario is: I am working on the report of firewall data in Splunk. The requirement is getting the distinct destination connected by source address. The table should contain: Source Address, Destination Address and Distinct count the number of Destination address connected by Source.
I am trying to use the dc query to get the distinct count for destination address but when doing table, i only can get source and distinct count number but the destination address value is missing.
Here is the query that I am using:

sourcetype="aws:cloudwatchlogs:vpcflow"
| dedup src dest | stats dc(dest) as
Count by src | table src dest Count |
sort src

Below is the output of the query:

Please help to suggest what query should I use to retain the destination address value.
Thanks,
Michael

Re: Missing original value after using distinct query

renjith_nair — Mon, 22 Jul 2019 05:22:13 GMT

@michaelhoang ,

Try

sourcetype="aws:cloudwatchlogs:vpcflow"
| stats dc(dest) as Count,values(dest) as dest by src

    sourcetype="aws:cloudwatchlogs:vpcflow"
    | stats dc(dest) as Count  by src,dest|eventstats sum(Count) as Count by src

topic Re: Missing original value after using distinct query in Splunk Search

Missing original value after using distinct query

Re: Missing original value after using distinct query