Splunk Search

How to filter table results?

pierre_weg
Path Finder

Hi all!

I have a table as a search result:

date    Country cs_username
2018-06-12  Mexico  mendoza
2018-06-12  Mexico  mendoza
2018-06-12  Mexico  mendoza
2018-06-14  Mexico  mendoza
2018-06-20  Mexico  mendoza
2018-06-22  Mexico  mendoza
2018-06-25  Mexico  mendoza
2018-06-26  Mexico  mendoza
2018-06-26  Mexico  mendoza
2018-06-11  Netherlands xing
2018-06-11  United States   xing
2018-06-11  Nigeria xing
2018-06-13  United States   xing
2018-06-14  United States   xing
2018-06-15  United States   xing
2018-06-17  United States   xing
2018-06-22  Brazil  xing
2018-06-24  United States   xing
2018-06-25  Brazil  xing
2018-06-25  Brazil  xing
2018-06-25  United States   xing
2018-06-17  China   xue
2018-06-18  China   xue
2018-06-20  China   xue
2018-06-21  China   xue
2018-06-22  China   xue
2018-06-22  China   xue
2018-06-22  Brazil  xue

Note that to the same days I have the same user and 2 different Countries.

 2018-06-11 xing
    2018-06-25 xing
    2018-06-22  xue

This is the condition that I have interest.
I need to filter the table results to show just this:

 2018-06-11 Netherlands xing
    2018-06-11  United States   xing
    2018-06-11  Nigeria xing
    2018-06-25  Brazil  xing
    2018-06-25  Brazil  xing
    2018-06-25  United States   xing
    2018-06-22  China   xue
    2018-06-22  China   xue
    2018-06-22  Brazil  xue

Can anyone help me?

Thanks a lot!

0 Karma
1 Solution

FrankVl
Ultra Champion

Add this to your current search:

| eventstats dc(Country) as count by cs_username,date
| where count>1

View solution in original post

0 Karma

FrankVl
Ultra Champion

Add this to your current search:

| eventstats dc(Country) as count by cs_username,date
| where count>1
0 Karma

pierre_weg
Path Finder

Great!

Thank you FrankVI.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...

Build and Launch AI Agents from Your Splunk Workflows

  Register We’ve all been there: juggling alerts, runbooks, and endless manual searches. What if you could ...

Splunk Cloud Application Management in Terraform

Register   On Tuesday, August 4 at 11AM PDT / 2PM EDT, we’re diving into how you can bring Infrastructure as ...