topic Re: Multiple results in Splunk Search

Multiple results

SN1 — Thu, 27 Mar 2025 07:56:01 GMT

hello i have this search

| inputlookup lkp-all-findings
| lookup lkp-findings-blacklist.csv blfinding as finding OUTPUTNEW blfinding
| lookup lkp-asset-list-master "IP Adresse" as ip OUTPUTNEW Asset_Gruppe Scan-Company Scanner Scan-Location Location "DNS Name" as dns_name Betriebssystem as "Operation System"
| lookup lkp-GlobalIpRange.csv 3-Letter-Code as Location OUTPUTNEW "Company Code"
| dedup finding, dns_name, ip
| stats values("Company Code") as "Company Code" by finding, dns_name, ip, Asset_Gruppe, Scan-Company, Scanner, Scan-Location, Location, Betriebssystem

now this is the result.

now i have tried mvexpand , stats as well but it gives multiples values. The problem is let say for NessusHost "slo-svenessus01.emea.durr.int" there are let say 20 nessus host with this name now it is duplicating 20 "company code " (HHDE) in every single field for each Nessushost with this name and same for others as well.

Re: Multiple results

gcusello — Thu, 27 Mar 2025 08:22:33 GMT

Hi @SN1 ,

you coult to use mvdedup:

Ciao.

Giuseppe

Re: Multiple results

ITWhisperer — Thu, 27 Mar 2025 09:03:24 GMT

This result doesn't look like the output of the search you shared, the values aggregation function already does a dedup i.e. you should only have unique values in the field, and the fields listed in the by clause of the stats command would appear first. Please clarify what your search was and the output you got from it.

Re: Multiple results

SN1 — Thu, 27 Mar 2025 09:54:16 GMT

Oh yes , sorry I gave wrong search . This is the seach

| inputlookup lkp-all-findings
| lookup lkp-findings-blacklist.csv blfinding as finding OUTPUTNEW blfinding
| lookup lkp-asset-list-master "IP Adresse" as ip OUTPUTNEW Asset_Gruppe Scan-Company Scanner Scan-Location Location "DNS Name" as dns_name Betriebssystem as "Operation System"
| lookup lkp-GlobalIpRange.csv 3-Letter-Code as Location OUTPUTNEW "Company Code"
| eval is_solved=if(lastchecked>lastfound OR lastchecked == 1,1,0),blacklisted=if(isnull(blfinding),0,1),timeval=strftime(lastchecked,"%Y-%m-%d")
| fillnull value="NA" "Company Code", Scan-Location
| search is_solved=0 blacklisted=0 Scan-Location="*" "Company Code"="*" severity="high"
| fields "Company Code" timeval ip dns "Operation System" severity pluginname timeval Scan-Location is_solved blacklisted
| sort severity

Re: Multiple results

ITWhisperer — Thu, 27 Mar 2025 10:16:58 GMT

| inputlookup lkp-all-findings | lookup lkp-findings-blacklist.csv blfinding as finding OUTPUTNEW blfinding | lookup lkp-asset-list-master "IP Adresse" as ip OUTPUTNEW Asset_Gruppe Scan-Company Scanner Scan-Location Location "DNS Name" as dns_name Betriebssystem as "Operation System" | lookup lkp-GlobalIpRange.csv 3-Letter-Code as Location OUTPUTNEW "Company Code" | eval is_solved=if(lastchecked>lastfound OR lastchecked == 1,1,0),blacklisted=if(isnull(blfinding),0,1),timeval=strftime(lastchecked,"%Y-%m-%d") | fillnull value="NA" "Company Code", Scan-Location | search is_solved=0 blacklisted=0 Scan-Location="*" "Company Code"="*" severity="high" | stats values("Company Code") as "Company Code" by timeval ip dns "Operation System" severity pluginname timeval Scan-Location is_solved blacklisted | fields "Company Code" timeval ip dns "Operation System" severity pluginname timeval Scan-Location is_solved blacklisted | sort severity

Re: Multiple results

SN1 — Thu, 27 Mar 2025 10:07:49 GMT

After running the search the "Company Code " field is empty

Re: Multiple results

ITWhisperer — Thu, 27 Mar 2025 10:15:40 GMT

Sorry, try with double quotes around "Company Code" in the values function

| stats values("Company Code") as "Company Code" by timeval ip dns "Operation System" severity pluginname timeval Scan-Location is_solved blacklisted

Re: Multiple results

SN1 — Thu, 27 Mar 2025 10:22:34 GMT

result is coming but the ones with similar names are not coming . where in dns field similar fields are not coming.

Re: Multiple results

ITWhisperer — Thu, 27 Mar 2025 10:58:38 GMT

So, the "Company Code" problem is solved, but now you have another problem? Please share more specifics?