Splunk Search

How to group by a column value

gautham
Explorer

Hi,

I'm searching for Windows Authentication logs and want to table activity of a user.

My Search query is :

index="win*" tag=authentication | stats values(src), values(dest), values(LogonType) by user | ....

I get Results like this.

alt text
But i am looking for some

0 Karma

somesoni2
Revered Legend

Try like this

index="win*" tag=authentication src=* dest=* LogonType=*  | stats values(src), values(dest), values(LogonType) by user
0 Karma

mhpark
Path Finder

have you tried this?

 | transaction user | table user, src, dest, LogonType | ...

and if you don't want events with no dest,
you should add

dest=*

to your search query.

pradeepkumarg
Influencer


index="win*" tag=authentication | stats values(user) by source,dest,LogonType | ....

0 Karma

gautham
Explorer

Thank you pradeep for your response.

But this search does not give the expected result. I do not want values(user) . I want unique value of User.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...