Splunk Search

Delete redundant information in fields

caplog
Engager

Hallo,

I would like to investigate the login behaviour of users. I use this search:

Unbenannt.png

I receive the following example log:

Unbenannt2.png

The "abstract" function creates the field "Kontoname". This contains the following values:

Unbenannt3.png

The values "Machine01p", "Machine02p", "Machine03p" are double information. How can I remove or exclude these values?

Many thanks for the support!

Labels (1)
0 Karma
1 Solution
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 3)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...