I have a time series data source where an alert writes an event indicating that the number of systems an account is logging into is increasing over a set window of time. in each event series, it lists all the machines including the new one that the account incremented by in a multivalue field.
Broken out by day, I'm trying to only display the unique machines
e.g.
| stats values(IPS) as ips values(computer) as dvcs by user _time
I tried to accomplish this using mvdedup but that is only capable of deduping multi-value in a given event not a full timeseries search result. Would love any advise you may have to accomplish this
Give this a try
Your current search giving fields _time user IPS computer
| bucket span=1d _time
| stats min(_time) as _time by user IPS computer
| stats values(IPS) as ips values(computer) as dvcs by user _time
Give this a try
Your current search giving fields _time user IPS computer
| bucket span=1d _time
| stats min(_time) as _time by user IPS computer
| stats values(IPS) as ips values(computer) as dvcs by user _time
You, sir, are a true gentlemen and a scholar! Thank you so much!