Splunk Search

How to group by a column value

gautham
Explorer

Hi,

I'm searching for Windows Authentication logs and want to table activity of a user.

My Search query is :

index="win*" tag=authentication | stats values(src), values(dest), values(LogonType) by user | ....

I get Results like this.

alt text
But i am looking for some

0 Karma

somesoni2
Revered Legend

Try like this

index="win*" tag=authentication src=* dest=* LogonType=*  | stats values(src), values(dest), values(LogonType) by user
0 Karma

mhpark
Path Finder

have you tried this?

 | transaction user | table user, src, dest, LogonType | ...

and if you don't want events with no dest,
you should add

dest=*

to your search query.

pradeepkumarg
Influencer


index="win*" tag=authentication | stats values(user) by source,dest,LogonType | ....

0 Karma

gautham
Explorer

Thank you pradeep for your response.

But this search does not give the expected result. I do not want values(user) . I want unique value of User.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...