Splunk Search

Group events based on content of field?

KMoryson
Explorer

I have the following table of activities:

Internal External Direction
1.1.1.1 2.2.2.2 Outbound
3.3.3.3 4.4.4.4 Inbound
5.5.5.5 4.4.4.4 Inbound
1.1.1.1 8.8.8.8 Outbound

 

I want to group them by either Internal OR External, based on what is in the Direction field, if its Outbound I want to group by Internal , if its Inbound I want to group by External, and get the count.
I would like to get the following table as a result:

Internal External Count Grouped by Direction
1.1.1.1 2.2.2.2
8.8.8.8
2 1.1.1.1 Outbound
3.3.3.3
5.5.5.5
4.4.4.4 2 4.4.4.4 Inbound


Thanks.

Labels (4)
0 Karma

FrankVl
Ultra Champion

So effectively you want to group by src_ip

...your existing query...
| eval src_ip = if(Direction="Outbound",Internal,External)
| stats values(Internal) as Internal values(External) as External count values(Direction) as Direction by src_ip

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eventstats values(Internal) as internals by External
| eventstats values(External) as externals by Internal
| eval groupby=if(Direction="Outbound",Internal,External)
| stats values(internals) as internals values(externals) as externals values(Direction) as Direction by groupby
| eval count=max(mvcount(internals), mvcount(externals))
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...