Splunk Search

How to filter table results?

pierre_weg
Path Finder

Hi all!

I have a table as a search result:

date    Country cs_username
2018-06-12  Mexico  mendoza
2018-06-12  Mexico  mendoza
2018-06-12  Mexico  mendoza
2018-06-14  Mexico  mendoza
2018-06-20  Mexico  mendoza
2018-06-22  Mexico  mendoza
2018-06-25  Mexico  mendoza
2018-06-26  Mexico  mendoza
2018-06-26  Mexico  mendoza
2018-06-11  Netherlands xing
2018-06-11  United States   xing
2018-06-11  Nigeria xing
2018-06-13  United States   xing
2018-06-14  United States   xing
2018-06-15  United States   xing
2018-06-17  United States   xing
2018-06-22  Brazil  xing
2018-06-24  United States   xing
2018-06-25  Brazil  xing
2018-06-25  Brazil  xing
2018-06-25  United States   xing
2018-06-17  China   xue
2018-06-18  China   xue
2018-06-20  China   xue
2018-06-21  China   xue
2018-06-22  China   xue
2018-06-22  China   xue
2018-06-22  Brazil  xue

Note that to the same days I have the same user and 2 different Countries.

 2018-06-11 xing
    2018-06-25 xing
    2018-06-22  xue

This is the condition that I have interest.
I need to filter the table results to show just this:

 2018-06-11 Netherlands xing
    2018-06-11  United States   xing
    2018-06-11  Nigeria xing
    2018-06-25  Brazil  xing
    2018-06-25  Brazil  xing
    2018-06-25  United States   xing
    2018-06-22  China   xue
    2018-06-22  China   xue
    2018-06-22  Brazil  xue

Can anyone help me?

Thanks a lot!

0 Karma
1 Solution

FrankVl
Ultra Champion

Add this to your current search:

| eventstats dc(Country) as count by cs_username,date
| where count>1

View solution in original post

0 Karma

FrankVl
Ultra Champion

Add this to your current search:

| eventstats dc(Country) as count by cs_username,date
| where count>1
0 Karma

pierre_weg
Path Finder

Great!

Thank you FrankVI.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...