How to remove duplicate values in a different field
|stats count by src dest
The most straightforward implementation is
| stats count by src dest
| where src != dest
Alternatively,
| where src != dest
| stats count by src dest
Where are the duplicates? I see the first 3 octets of some IP addresses match, but stats looks at the entire field, not just parts of it. If you need to deduplicate on the first 3 octets, then use rex or split to extract it into a new field and dedup on that new field.
@richgalloway Thanks for the reply
I am getting similar IPs in both src & dest fields.
So I want to remove in results if both src & dest are the same.
The most straightforward implementation is
| stats count by src dest
| where src != dest
Alternatively,
| where src != dest
| stats count by src dest
Hi @alexspunkshell,
Please confirm if I understood your requirement correctly: -
There are two fields in the result: - src and dest.
If in a given row both src and dest are same, then you need to filter out those rows from the result.
Thank you
@Taruchit You are right.