How to get multiple values in a table

[brentsinawski]

Hi everyone,
I am trying to create a table that lists multiple policy id's that shows all ports being used according to that policy ID. If I do a "| dedup policy_id | table policy_id dst_port src_port I get only one dst_port and one src_port. I'm looking to do a list of all the policy id with every port that policy id has used in a specific time. Hard to explain I guess.
I'm looking for

policy_id src_port dst_port
836 5622 5488 80 66 488 224 etc.

Any help would be extremely appreciated.
Thank you!!

[sdaniels · Accepted solution]

You should try using stats with the values function:

| stats values(src_port) values(dst_port) by policy_id

[sdaniels]

There are a lot of options so it takes some time to see it all. I've seen at least 5%, so far of what Splunk can do.

[brentsinawski]

Can't believe I couldn't figure that out. Your a life saver. Thank you very much!! Worked perfectly.