Splunk Search

Consolidating table entries

dwear
Explorer

192.168.1.7 |table Realm, Role

I have a search and I'm trying to consolidate to unique combinations of Realm and Role.

 Realm         Role
 Realm A      Role A
 Realm A      Role A
 Realm A      Role A
 Realm A      Role B
 Realm A      Role A
 Realm B      Role B
 Realm B      Role C

As you can see above, there is duplicates. I tried "|dedup Realm" but I feel like its eliminating some unique combinations by eliminating duplicate Realms. I'd like see if look like this.

 Realm         Role
 Realm A      Role A
 Realm A      Role B
 Realm B      Role B
 Realm B      Role C
Tags (1)
0 Karma

Stevelim
Communicator
| stats values(Realm)  as Realm, values(Role)  as Role
0 Karma

woodcock
Esteemed Legend

Use 2 fields, like this:

192.168.1.7 | dedup Realm Role | table Realm Role
0 Karma

javiergn
Super Champion

Faster and nicer than dedup:

| stats count by Realm, Role
| fields - count
0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...