Splunk Search

How to group by a column value

gautham
Explorer

Hi,

I'm searching for Windows Authentication logs and want to table activity of a user.

My Search query is :

index="win*" tag=authentication | stats values(src), values(dest), values(LogonType) by user | ....

I get Results like this.

alt text
But i am looking for some

0 Karma

somesoni2
Revered Legend

Try like this

index="win*" tag=authentication src=* dest=* LogonType=*  | stats values(src), values(dest), values(LogonType) by user
0 Karma

mhpark
Path Finder

have you tried this?

 | transaction user | table user, src, dest, LogonType | ...

and if you don't want events with no dest,
you should add

dest=*

to your search query.

pradeepkumarg
Influencer


index="win*" tag=authentication | stats values(user) by source,dest,LogonType | ....

0 Karma

gautham
Explorer

Thank you pradeep for your response.

But this search does not give the expected result. I do not want values(user) . I want unique value of User.

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...