How to display output of the stats values function for two fields that have corresponding/related values

[ezmo1982]

Hi,

I have the below search:

| tstats values(Authentication.src_ip) as src_ip values(Authentication.src_host) as src_host
from datamodel=Authentication.Authentication where Authentication.user=*
by Authentication.dest, Authentication.action, Authentication.user, Authentication.app | `drop_dm_object_name("Authentication")`
| stats count(eval(action=="failure")) as failure, count(eval(action=="success")) as success, dc(dest) as dest_count, values(src_ip) as src_ip, values(src_host) as src_host

The search will display values of certain fields from the Authentication data model. Two of the fields have multivalues stored in them - Authentication.src. and Authentication.src_host. Authentication.src_host is a calculated eval field of the datamodel that performs a dns lookup of the Authentication.src field (which is an IP address)

The problem Im having is that the stats values command will display columns of the values of these two fields in alphanumeric order when I run the above search. Which basically means that the src value will not be displayed inline with its correct corresponding src_host value. From below example, src_host value for 10.1.1.1 is actually chost, but a_host is displayed alongside it as it is sorted alphanumerically.

src             src_host

10.1.1.1   a_host

10.1.1.2   b_host

10.1.1.3   c_host

Is there a way I can output the values of the src_host field with its corresponding correct value for the src field?

Thanks!

[ITWhisperer]

stats list(src_ip) as src_ip rather than values will preserve the order although you could get duplicates. Alternatively, can you do the lookup of the hostname after the stats?