Splunk Search

How do I filter out event based on a value that presents only in specific event?

frank_zhang
Path Finder

Hi,

I have a search produces the following 4 events, I'd like to filter all events for an IP if any event for that IP has I2A=1, i.e. filter out both events for 1.1.1.1 and the final results should only keep the two events for 2.2.2.2

| IP      | A2I | I2A |
| 1.1.1.1 | 1   | 0   |
| 1.1.1.1 | 0   | 1   |
| 2.2.2.2 | 0   | 0   |
| 2.2.2.2 | 1   | 0   |

Thanks.

Tags (2)
0 Karma
1 Solution

gfuente
Motivator

Hello

You can use the eventstats command to get this

yourbasesearch | eventstats max(I2A) as MAXI2A by IP | search MAXI2A="0" | ...

Regards

View solution in original post

gfuente
Motivator

Hello

You can use the eventstats command to get this

yourbasesearch | eventstats max(I2A) as MAXI2A by IP | search MAXI2A="0" | ...

Regards

frank_zhang
Path Finder

Thanks for your solution.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...