Deployment Architecture

How to build search for associate event code of a user?

debjit_k
Path Finder

Hi 

Hope you are doing good..

I want to build one query where I will get user with associate event code or IP for example 

If I use stats count by user, event code

I will get 

User event code 

Abc  1

Abc  2

 

But I want output like 

User event code 

Abc  1, 2 

I.e. User name should not get repeat for different event code 

 

Can you please guide me here 

 

Thanks 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

you should use values in your stats command, something like this:

<your_search>
| stats values(EventCode) AS EventCode values(ip) AS ip BY user

Ciao.

Giuseppe

View solution in original post

0 Karma

debjit_k
Path Finder

Hi @gcusello ,

thank you for the support I actually use list function. 

Thanks 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

you should use values in your stats command, something like this:

<your_search>
| stats values(EventCode) AS EventCode values(ip) AS ip BY user

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...