Splunk Search

Dedup on multiple fields but count the instance, and display as new field.

kearnwl
Engager

Original Data

SrcIP       SrcName     DstIP       DstName         DstPort 
192.168.1.1 bob.net.net 172.16.16.1 alice.net.net   21
192.168.1.1 bob.net.net 172.16.16.1 alice.net.net   21

Data that I would like to Display

SrcIP           SrcName     DstIP       DstName     DstPort     Count
192.168.1.1     bob.net.net 172.16.16.1 alice.net.net   21      2
Tags (3)
1 Solution

Ayn
Legend
... | stats count by SrcIP SrcName DstIP DstName DstPort

View solution in original post

kearnwl
Engager

Ok... wow, that was much easier than I thought. Thanks for helping me, and making me feel more than a little silly.

0 Karma

Ayn
Legend

No problem 🙂 That's often the case with Splunk - seemingly difficult task can be solved surprisingly easy by finding the right command and arguments!

Could you please mark my answer as accepted? Thanks!

0 Karma

Ayn
Legend
... | stats count by SrcIP SrcName DstIP DstName DstPort
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...