Getting Data In

getting duplicate fields from splunk result

ektasiwani
Communicator

Hi,

My requirement is to find is same pair of source and ip addresses are being used.
for example if this is my table

src_ip ,dest_ip,action
192.168.10.2,192.168.10.3,block
192.168.10.21,192.168.10.13,block
192.168.10.2,192.168.10.3,allow

i want as a result:
192.168.10.2,192.168.10.3,allow
192.168.10.2,192.168.10.3,block

How to achieve this?

Thanks

Tags (2)
0 Karma
1 Solution

tom_frotscher
Builder

Hi,

you can use the dedup command:

... | dedup src_ip dest_ip action

or you can use stats:

... | stats count by src_ip dest_ip action | fields -count

If possible, you should use stats, it should be faster than dedup. But without further ado, after a stats you only have the fields left, that you used in your by clause.

Greetings

Tom

View solution in original post

chanmi2
Path Finder

you may try this:

... | eventstats count by src_ip ,dest_ip | where count = 2
0 Karma

tom_frotscher
Builder

Hi,

you can use the dedup command:

... | dedup src_ip dest_ip action

or you can use stats:

... | stats count by src_ip dest_ip action | fields -count

If possible, you should use stats, it should be faster than dedup. But without further ado, after a stats you only have the fields left, that you used in your by clause.

Greetings

Tom

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...