Deployment Architecture

How to build search for associate event code of a user?

debjit_k
Path Finder

Hi 

Hope you are doing good..

I want to build one query where I will get user with associate event code or IP for example 

If I use stats count by user, event code

I will get 

User event code 

Abc  1

Abc  2

 

But I want output like 

User event code 

Abc  1, 2 

I.e. User name should not get repeat for different event code 

 

Can you please guide me here 

 

Thanks 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

you should use values in your stats command, something like this:

<your_search>
| stats values(EventCode) AS EventCode values(ip) AS ip BY user

Ciao.

Giuseppe

View solution in original post

0 Karma

debjit_k
Path Finder

Hi @gcusello ,

thank you for the support I actually use list function. 

Thanks 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

you should use values in your stats command, something like this:

<your_search>
| stats values(EventCode) AS EventCode values(ip) AS ip BY user

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...