Getting Data In

getting duplicate fields from splunk result

ektasiwani
Communicator

Hi,

My requirement is to find is same pair of source and ip addresses are being used.
for example if this is my table

src_ip ,dest_ip,action
192.168.10.2,192.168.10.3,block
192.168.10.21,192.168.10.13,block
192.168.10.2,192.168.10.3,allow

i want as a result:
192.168.10.2,192.168.10.3,allow
192.168.10.2,192.168.10.3,block

How to achieve this?

Thanks

Tags (2)
0 Karma
1 Solution

tom_frotscher
Builder

Hi,

you can use the dedup command:

... | dedup src_ip dest_ip action

or you can use stats:

... | stats count by src_ip dest_ip action | fields -count

If possible, you should use stats, it should be faster than dedup. But without further ado, after a stats you only have the fields left, that you used in your by clause.

Greetings

Tom

View solution in original post

chanmi2
Path Finder

you may try this:

... | eventstats count by src_ip ,dest_ip | where count = 2
0 Karma

tom_frotscher
Builder

Hi,

you can use the dedup command:

... | dedup src_ip dest_ip action

or you can use stats:

... | stats count by src_ip dest_ip action | fields -count

If possible, you should use stats, it should be faster than dedup. But without further ado, after a stats you only have the fields left, that you used in your by clause.

Greetings

Tom

Get Updates on the Splunk Community!

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...