Getting Data In

Help with filtering results

jambajuice
Communicator

I have results that look like the following

dest_ip, dest_port, protocol, cve_id, score

192.168.1.1, 80, tcp, 2009-1234, 8.5
192.168.1.1, 80, tcp, 2007-6543, 9
192.168.1.1, 80, tcp, 2004-8435, 6

If I want to return the result for each dest_ip/dest_port combination that has the highest score, how do I do that? I've tried using sort and dedup to sort the fields by score (descending) and then dedup the results, but it isn't working.

Any help would be appreciated.

Thx.

Craig

Tags (1)

jambajuice
Communicator

I figured it out:

dedup dest_ip,dest_port sortby -score

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...

Data Management Digest – August 2026

Data Management Digest   Welcome to the August 2026 edition of Data Management Digest! August was a big month ...