Splunk Search

How to filter table results?

pierre_weg
Path Finder

Hi all!

I have a table as a search result:

date    Country cs_username
2018-06-12  Mexico  mendoza
2018-06-12  Mexico  mendoza
2018-06-12  Mexico  mendoza
2018-06-14  Mexico  mendoza
2018-06-20  Mexico  mendoza
2018-06-22  Mexico  mendoza
2018-06-25  Mexico  mendoza
2018-06-26  Mexico  mendoza
2018-06-26  Mexico  mendoza
2018-06-11  Netherlands xing
2018-06-11  United States   xing
2018-06-11  Nigeria xing
2018-06-13  United States   xing
2018-06-14  United States   xing
2018-06-15  United States   xing
2018-06-17  United States   xing
2018-06-22  Brazil  xing
2018-06-24  United States   xing
2018-06-25  Brazil  xing
2018-06-25  Brazil  xing
2018-06-25  United States   xing
2018-06-17  China   xue
2018-06-18  China   xue
2018-06-20  China   xue
2018-06-21  China   xue
2018-06-22  China   xue
2018-06-22  China   xue
2018-06-22  Brazil  xue

Note that to the same days I have the same user and 2 different Countries.

 2018-06-11 xing
    2018-06-25 xing
    2018-06-22  xue

This is the condition that I have interest.
I need to filter the table results to show just this:

 2018-06-11 Netherlands xing
    2018-06-11  United States   xing
    2018-06-11  Nigeria xing
    2018-06-25  Brazil  xing
    2018-06-25  Brazil  xing
    2018-06-25  United States   xing
    2018-06-22  China   xue
    2018-06-22  China   xue
    2018-06-22  Brazil  xue

Can anyone help me?

Thanks a lot!

0 Karma
1 Solution

FrankVl
Ultra Champion

Add this to your current search:

| eventstats dc(Country) as count by cs_username,date
| where count>1

View solution in original post

0 Karma

FrankVl
Ultra Champion

Add this to your current search:

| eventstats dc(Country) as count by cs_username,date
| where count>1
0 Karma

pierre_weg
Path Finder

Great!

Thank you FrankVI.

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...