I want to divide different multi-values based on IP.
Current results:
IP | date | event | risk |
1.1.1.1 | 2022-01-01 2022-01-02 | apache struts ipv4 fragment | high row |
my search:
mysearch
| mvexpand date
| mvexpand event
| mvexpand risk
| table ip date event risk
reuslt:
IP | date | event | risk |
1.1.1.1 | 2022-01-01 | apache struts | high |
1.1.1.1 | 2022-01-01 | apache struts | row |
1.1.1.1 | 2022-01-01 | ipv4 fragment | high |
1.1.1.1 | 2022-01-01
| ipv4 fragment | row |
1.1.1.1 | 2022-01-02 | apache struts | high |
1.1.1.1 | 2022-01-02 | apache struts | row |
1.1.1.1 | 2022-01-02 | ipv4 fragment | high |
1.1.1.1 | 2022-01-02 | ipv4 fragment | row |
I want
IP | date | event | risk |
1.1.1.1 | 2022-01-01 | apache struts | high |
1.1.1.1 | 2022-01-02 | ipv4 fragment | row |
please help me...
Try this:
MySearch
| eval combined=mvzip(mvzip(event, risk, "|"), date, "|")
| mvexpand combined
| rex field=combined "^(?<date>[^|]*)\|(?<event>[^|]*)\|(?<risk>[^|]*)"
| table ip date event risk
If your data contains "|", you can use a different delimiter like ";".
Oh, thank you so much.
I think just dedup on event field would do ..
The grouping command is called, unintuitively, stats. Events are grouped by the fields specified in the by clause, like this:
| stats values(*) as * by event
| table IP date event risk
Another way is like this:
| stats count by IP date event risk
| table IP date event risk