How to add contributing fields to unique values?

girtsgr — Thu, 19 May 2022 16:28:26 GMT

Hi, I seem to be stuck with something pretty trivial. I have events with users and corresponding hostnames, eg:

User	Hostname
user1	hostA
user1	hostB
user2	hostA
user2	hostC
user3	hostD

I want to count unique user-hostname values and show the contributing hostnames for users that have used more that 1 hostname like this:

User	Hostnames used
user1	hostA hostB
user2	hostA hostC

This seems to take care of the first part of the task:

| stats dc(Hostname) as uh by User | search uh > 1

How can I add the contributing Hostnames?

Formatting is not so important - it may be one field with all the hostnames like in the example above, or multiple fields, or one field together with the User field.

Thank you.

Re: Add contributing fields to unique values

ITWhisperer — Thu, 19 May 2022 14:28:36 GMT

| stats values(hostname) as hostnames by User | eval uh=mvcount(hostnames) | where uh > 1

Re: Add contributing fields to unique values

girtsgr — Fri, 20 May 2022 09:35:57 GMT

Thank you! 🙂

topic Re: Add contributing fields to unique values in Splunk Search

How to add contributing fields to unique values?

Re: Add contributing fields to unique values

Re: Add contributing fields to unique values