topic Re: How to group by a column value in Splunk Search

How to group by a column value

gautham — Tue, 23 Aug 2016 14:13:47 GMT

Hi,

I'm searching for Windows Authentication logs and want to table activity of a user.

My Search query is :

index="win*" tag=authentication | stats values(src), values(dest), values(LogonType) by user | ....

I get Results like this.

But i am looking for some

pradeepkumarg — Tue, 23 Aug 2016 15:57:35 GMT

index="win*" tag=authentication | stats values(user) by source,dest,LogonType | ....

gautham — Wed, 24 Aug 2016 13:45:07 GMT

Thank you pradeep for your response.

But this search does not give the expected result. I do not want values(user) . I want unique value of User.

mhpark — Wed, 24 Aug 2016 14:05:49 GMT

have you tried this?

 | transaction user | table user, src, dest, LogonType | ...

and if you don't want events with no dest,
you should add

dest=*

to your search query.

somesoni2 — Wed, 24 Aug 2016 15:36:05 GMT

Try like this

index="win*" tag=authentication src=* dest=* LogonType=*  | stats values(src), values(dest), values(LogonType) by user