Splunk Enterprise Security

How to count Stats by two Fields in one search

hyleung
New Member

I have tired the following commands to retrieve the results, but it fails.

|from datamodel:"Authentication"."Failed _Authentication" | stats values(user) count by (action=failure), src | sort -count

or

|from datamodel:"Authentication"."Failed _Authentication" | stats values(user) values(src) count by (action=failure) | sort -count

And I want to achieve the following results.

+-------+--------+-------+
| User | src | count |
+-------+--------+-------+
| Mary | IT1001 | 10 |
+-------+--------+-------+
| Mary | IT1002 | 6 |
+-------+--------+-------+
| Peter | IT2002 | 9 |
+-------+--------+-------+
| Alan | IT3003 | 8 |
+-------+--------+-------+

Please help me. Thanks.

0 Karma

tiagofbmm
Influencer
 |from datamodel:"Authentication"."Failed _Authentication" | where Authentication.action="failure" | stats values(src), count by user   | sort -count
0 Karma

renjith_nair
Legend

@hyleung,

|from datamodel:"Authentication"."Failed _Authentication"|stats count by user,src
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...