Splunk Search

Group events based on content of field?

KMoryson
Explorer

I have the following table of activities:

Internal External Direction
1.1.1.1 2.2.2.2 Outbound
3.3.3.3 4.4.4.4 Inbound
5.5.5.5 4.4.4.4 Inbound
1.1.1.1 8.8.8.8 Outbound

 

I want to group them by either Internal OR External, based on what is in the Direction field, if its Outbound I want to group by Internal , if its Inbound I want to group by External, and get the count.
I would like to get the following table as a result:

Internal External Count Grouped by Direction
1.1.1.1 2.2.2.2
8.8.8.8
2 1.1.1.1 Outbound
3.3.3.3
5.5.5.5
4.4.4.4 2 4.4.4.4 Inbound


Thanks.

Labels (4)
0 Karma

FrankVl
Ultra Champion

So effectively you want to group by src_ip

...your existing query...
| eval src_ip = if(Direction="Outbound",Internal,External)
| stats values(Internal) as Internal values(External) as External count values(Direction) as Direction by src_ip

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eventstats values(Internal) as internals by External
| eventstats values(External) as externals by Internal
| eval groupby=if(Direction="Outbound",Internal,External)
| stats values(internals) as internals values(externals) as externals values(Direction) as Direction by groupby
| eval count=max(mvcount(internals), mvcount(externals))
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...