How do I create a new summarized field based on other field values?

[memorecks]

Hi guys

First of all, please excuse, I'm an absolute newbie in regards to Splunk. I'm trying to do the following. From a search, I received a list of users that tried to execute tools categorized as hacking tools by our endpoint protection. Basically, searching for certain signatures.

I'm already using the "bucket" function to span/aggregate events together within 24 hours. The goal is to receive one alert per user and day. Also, I'm using the dedup function, where the fields "user", "threatname", and "hostname" must be the same to sort out duplicate events. Now, I'm facing the case where one user has more than one computer. Because of that, I'm receiving two or more alerts if a user has more than one computer per day.

Would it be possible to create a new field called "hosts" as an example, where all the hostnames are summarized related to a specific user if the "dedup" parameters match? So that i only receive one alert per user/day and all the hosts are summarized in one field.

Here is the query:

 index=* DomainName=* signature="*HackTool*" OR signature=*Tool-NetCat* OR signature="*HTool*" OR signature="*Tool-PassView*" OR signature="*MeteTool*" OR signature="*Metasploit*" OR signature="*Tool-Nmap*" OR signature="*PowerSSH*" OR signature="*PWCrack*" OR signature="*Backdoor*" OR signature="*Webshell*" OR signature="*Mimikatz*" OR signature="*RemAdm" OR signature="*Exploit*" OR signature="*Generic PWCrack*" OR signature="*WebShell*"

| eval user=lower(user)
| dedup ThreatName user AnalyzerHostName
| bucket _time span=24h
| table  _time ThreatName ThreatType action ThreatActionTaken event_description detection_method user AnalyzerHostName 
  os_type IPAddress DomainName file_name file_hash

Thanks in advance for your consideration and assistance.

[bcyates · Accepted solution]

Did you try via stats values? Assuming AnalyzerHostName is the field you want to aggregate, replace your table with this..

| stats values(AnalyzerHostName) by userThreatName ThreatType action ThreatActionTaken event_description detection_method _time