Splunk Search

How to only show only unique values over timeseries data with stats

mjones414
Contributor

I have a time series data source where an alert writes an event indicating that the number of systems an account is logging into is increasing over a set window of time.  in each event series, it lists all the machines including the new one that the account incremented by in a multivalue field. 

Broken out by day, I'm trying to only display the unique machines
e.g. 
| stats values(IPS) as ips values(computer) as dvcs by user _time

I tried to accomplish this using mvdedup but that is only capable of deduping multi-value in a given event not a full timeseries search result.  Would love any advise you may have to accomplish this

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

Your current search giving fields _time user IPS computer
| bucket span=1d _time 
| stats min(_time) as _time by user IPS computer 
| stats values(IPS) as ips values(computer) as dvcs by user _time

View solution in original post

somesoni2
Revered Legend

Give this a try

Your current search giving fields _time user IPS computer
| bucket span=1d _time 
| stats min(_time) as _time by user IPS computer 
| stats values(IPS) as ips values(computer) as dvcs by user _time

mjones414
Contributor

You, sir, are a true gentlemen and a scholar!  Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...