Splunk Enterprise Security

How to display count of two different fields with different values?

i471
New Member

Hello all I'm having difficulties figuring out how to output 2 seperate counts for 2 seperate fields.

index=email spf="fail*" OR dkim="fail*"
| dedup message_id
| stats count BY spf, dkim

Atttempting to return a single count of the unique logs that contain spf="fail" and a single count of unique logs that contain dkim="fail" :

spf dkim

14 75

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @i471,
you could try something like this.

index=email spf="fail*" OR dkim="fail*"
| dedup message_id
| eval kind=if(like(spf,"fail%"),"spf",if(like(dkim,"fail%"),"dkim",""))
| search kind!=""
| stats count BY kind

Ciao.
Giuseppe

0 Karma

i471
New Member

Updated search: index=email spf="fail" OR dkim="fail"

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...

Splunk ITSI & Correlated Network Visibility

 Take Your Network Visibility to the Next LevelIn today’s complex IT environments, performance issues can stem ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...