Splunk Search

Group repeating values of a field

jedatt01
Builder

I have a csv data source with example values as follows

MAC_ID, SSID
AAAA.AAAA.AAAA, TEST
BBBB.BBBB.BBBB, TEST
CCCC.CCCC.CCCC, TEST2
AAAA.AAAA.AAAA, TEST2
BBBB.BBBB.BBBB, TEST3

I want to be able to display a table that shows repeating values of MAC_ID like below
AAAA.AAAA.AAAA, TEST, TEST2
BBBB.BBBB.BBBB, TEST, TEST3

please help!

Tags (1)
0 Karma
2 Solutions

lukejadamec
Super Champion

I don't think you can do that on a large scale. If the MAC_IDs and SSID's were known, then you could create a look up table matrix.

What you're asking for is changing the SSID field into a new field based on the SSID.

This would be easy with a table, but it would be vertical, not horizontal:

search | table MAC_ID,SSID | sort -MAC_ID

View solution in original post

0 Karma

adityapavan18
Contributor

Try something like this

|inputlookup something.csv | stats count values(SSID) by MACID | where count > 1

This will show you the MAC ID having repetitive values.

View solution in original post

adityapavan18
Contributor

Try something like this

|inputlookup something.csv | stats count values(SSID) by MACID | where count > 1

This will show you the MAC ID having repetitive values.

View solution in original post

jedatt01
Builder

Thanks, this got me far enough that it worked

0 Karma

sowings
Splunk Employee
Splunk Employee

Note that values() normalizes the list, and sorts them, while list() would give you each and every occurrence, in the order in which it appears in the log. In this case, values is probably what you want, but list can have its utility, too.

0 Karma

lukejadamec
Super Champion

I don't think you can do that on a large scale. If the MAC_IDs and SSID's were known, then you could create a look up table matrix.

What you're asking for is changing the SSID field into a new field based on the SSID.

This would be easy with a table, but it would be vertical, not horizontal:

search | table MAC_ID,SSID | sort -MAC_ID

View solution in original post

0 Karma

jedatt01
Builder

Same with this one, worked for me as well

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!