Splunk Search

Group events based on content of field?

KMoryson
Explorer

I have the following table of activities:

Internal External Direction
1.1.1.1 2.2.2.2 Outbound
3.3.3.3 4.4.4.4 Inbound
5.5.5.5 4.4.4.4 Inbound
1.1.1.1 8.8.8.8 Outbound

 

I want to group them by either Internal OR External, based on what is in the Direction field, if its Outbound I want to group by Internal , if its Inbound I want to group by External, and get the count.
I would like to get the following table as a result:

Internal External Count Grouped by Direction
1.1.1.1 2.2.2.2
8.8.8.8
2 1.1.1.1 Outbound
3.3.3.3
5.5.5.5
4.4.4.4 2 4.4.4.4 Inbound


Thanks.

Labels (4)
0 Karma

FrankVl
Ultra Champion

So effectively you want to group by src_ip

...your existing query...
| eval src_ip = if(Direction="Outbound",Internal,External)
| stats values(Internal) as Internal values(External) as External count values(Direction) as Direction by src_ip

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eventstats values(Internal) as internals by External
| eventstats values(External) as externals by Internal
| eval groupby=if(Direction="Outbound",Internal,External)
| stats values(internals) as internals values(externals) as externals values(Direction) as Direction by groupby
| eval count=max(mvcount(internals), mvcount(externals))
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...