Splunk Search

How to display output of the stats values function for two fields that have corresponding/related values

ezmo1982
Path Finder

Hi,

I have the below search:

| tstats values(Authentication.src_ip) as src_ip values(Authentication.src_host) as src_host
from datamodel=Authentication.Authentication where Authentication.user=*
by Authentication.dest, Authentication.action, Authentication.user, Authentication.app | `drop_dm_object_name("Authentication")`
| stats count(eval(action=="failure")) as failure, count(eval(action=="success")) as success, dc(dest) as dest_count, values(src_ip) as src_ip, values(src_host) as src_host

The search will display values of certain fields from the Authentication data model. Two of the fields have multivalues stored in them - Authentication.src. and Authentication.src_host. Authentication.src_host is a calculated eval field of the datamodel that performs a dns lookup of the Authentication.src field (which is an IP address)

The problem Im having is that the stats values command will display columns of the values of these two fields in alphanumeric order when I run the above search. Which basically means that the src value will not be displayed inline with its correct corresponding src_host value. From below example, src_host value for 10.1.1.1 is actually chost, but a_host is displayed alongside it as it is sorted alphanumerically.

src             src_host

10.1.1.1   a_host

10.1.1.2   b_host

10.1.1.3   c_host

Is there a way I can output the values of the src_host field with its corresponding correct value for the src field?

Thanks!

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

stats list(src_ip) as src_ip rather than values will preserve the order although you could get duplicates. Alternatively, can you do the lookup of the hostname after the stats?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...