Splunk Search

How to group by a column value



I'm searching for Windows Authentication logs and want to table activity of a user.

My Search query is :

index="win*" tag=authentication | stats values(src), values(dest), values(LogonType) by user | ....

I get Results like this.

alt text
But i am looking for some

0 Karma

Revered Legend

Try like this

index="win*" tag=authentication src=* dest=* LogonType=*  | stats values(src), values(dest), values(LogonType) by user
0 Karma

Path Finder

have you tried this?

 | transaction user | table user, src, dest, LogonType | ...

and if you don't want events with no dest,
you should add


to your search query.

0 Karma


index="win*" tag=authentication | stats values(user) by source,dest,LogonType | ....

0 Karma


Thank you pradeep for your response.

But this search does not give the expected result. I do not want values(user) . I want unique value of User.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...