I am trying to remove duplicate from a field result:
index=tenable* sourcetype="*" severity_description="*" | table severity_description ip | stats count by severity_description
Results:
Severity_description Count
Critical Severity = 518
High Severity. =. 46837
Medium Severity. = 7550
Low Severity. =. 1460
Informative. =. 275192
Inside each of severity_description row there are duplicates i know that by running:
index=tenable* sourcetype="*" severity_description="Critical Severity" | table ip riskFactor | stats dc(ip) AS ip |rename ip as Critical | addcoltotals | stats sum(Critical) as Critical
Results:
critical =128
I am trying to run the first search and remove the duplicates automatically from from each row
Give this a try
index=tenable* sourcetype="*" severity_description="*" | stats dc(ip) as count by severity_description