https://community.splunk.com/t5/Splunk-Search/Table-count-dedup/m-p/91022#M23413 <P>Have a basic report being built and I am having troubles with counts/dedup so to say. Below is my current output. What I would like are 1 of the 2 outputs further below, either with a count and the other fields can be overwritten with whatever the last found value was, or extra special if I could concat the values like at the very bottom. Any ideas?</P> <P>source="Firewall" | table source dest blah1 blah2</P> <P>source dest blah1 blah2</P> <P>10.1.1.1 1.2.3.4 A B</P> <P>10.1.1.1 1.2.3.4 B B</P> <P>10.1.1.2 1.2.3.4 A B<BR /> <BR /> Attempted searches</P> <P>source="Firewall" | stats count by source dest blah1 blah2 count</P> <P>source="Firewall" | stats count by source | table source dest blah1 blah2 count</P> <P>source="Firewall" | stats count by source | join ?????? various types tried<BR /> <BR /> Output needed</P> <P>source dest blah1 blah2 count</P> <P>10.1.1.1 1.2.3.4 A B 2</P> <P>10.1.1.2 1.2.3.4 A B 1<BR /> <BR /> Or preferred</P> <P>source dest blah1 blah2 count</P> <P>10.1.1.1 1.2.3.4 A,B B,B 2</P> <P>10.1.1.2 1.2.3.4 A B 1</P> Tue, 13 Mar 2012 17:57:28 GMT axinjakson 2012-03-13T17:57:28Z https://community.splunk.com/t5/Splunk-Search/Table-count-dedup/m-p/91022#M23413 <P>Have a basic report being built and I am having troubles with counts/dedup so to say. Below is my current output. What I would like are 1 of the 2 outputs further below, either with a count and the other fields can be overwritten with whatever the last found value was, or extra special if I could concat the values like at the very bottom. Any ideas?</P> <P>source="Firewall" | table source dest blah1 blah2</P> <P>source dest blah1 blah2</P> <P>10.1.1.1 1.2.3.4 A B</P> <P>10.1.1.1 1.2.3.4 B B</P> <P>10.1.1.2 1.2.3.4 A B<BR /> <BR /> Attempted searches</P> <P>source="Firewall" | stats count by source dest blah1 blah2 count</P> <P>source="Firewall" | stats count by source | table source dest blah1 blah2 count</P> <P>source="Firewall" | stats count by source | join ?????? various types tried<BR /> <BR /> Output needed</P> <P>source dest blah1 blah2 count</P> <P>10.1.1.1 1.2.3.4 A B 2</P> <P>10.1.1.2 1.2.3.4 A B 1<BR /> <BR /> Or preferred</P> <P>source dest blah1 blah2 count</P> <P>10.1.1.1 1.2.3.4 A,B B,B 2</P> <P>10.1.1.2 1.2.3.4 A B 1</P> Tue, 13 Mar 2012 17:57:28 GMT https://community.splunk.com/t5/Splunk-Search/Table-count-dedup/m-p/91022#M23413 axinjakson 2012-03-13T17:57:28Z https://community.splunk.com/t5/Splunk-Search/Table-count-dedup/m-p/91023#M23414 <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions</A> so</P> <PRE><CODE>... | stats latest(blah1) as blah1, latest(blah2) as blah2, count by src,dest </CODE></PRE> <P>or </P> <PRE><CODE>... | stats values(blah1) as blah1, values(blah2) as blah2, count by src,dest </CODE></PRE> <P>or</P> <PRE><CODE>... | stats list(blah1) as blah1, list(blah2) as blah2, count by src,dest </CODE></PRE> Tue, 13 Mar 2012 18:45:43 GMT https://community.splunk.com/t5/Splunk-Search/Table-count-dedup/m-p/91023#M23414 gkanapathy 2012-03-13T18:45:43Z