Splunk Search

How to only show only unique values over timeseries data with stats

mjones414
Contributor

I have a time series data source where an alert writes an event indicating that the number of systems an account is logging into is increasing over a set window of time.  in each event series, it lists all the machines including the new one that the account incremented by in a multivalue field. 

Broken out by day, I'm trying to only display the unique machines
e.g. 
| stats values(IPS) as ips values(computer) as dvcs by user _time

I tried to accomplish this using mvdedup but that is only capable of deduping multi-value in a given event not a full timeseries search result.  Would love any advise you may have to accomplish this

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

Your current search giving fields _time user IPS computer
| bucket span=1d _time 
| stats min(_time) as _time by user IPS computer 
| stats values(IPS) as ips values(computer) as dvcs by user _time

View solution in original post

somesoni2
Revered Legend

Give this a try

Your current search giving fields _time user IPS computer
| bucket span=1d _time 
| stats min(_time) as _time by user IPS computer 
| stats values(IPS) as ips values(computer) as dvcs by user _time

mjones414
Contributor

You, sir, are a true gentlemen and a scholar!  Thank you so much!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...