How to remove Duplicate values in different field?

[alexspunkshell]

How to remove duplicate values in a different field

|stats count by src dest

[richgalloway]

Where are the duplicates?  I see the first 3 octets of some IP addresses match, but stats looks at the entire field, not just parts of it.  If you need to deduplicate on the first 3 octets, then use rex or split to extract it into a new field and dedup on that new field.

[alexspunkshell]

@richgalloway  Thanks for the reply

I am getting similar IPs in both src & dest fields.

So I want to remove in results if both src & dest are the same.

[yuanliu · Accepted solution]

The most straightforward implementation is

| stats count by src dest
| where src != dest

Alternatively,

| where src != dest
| stats count by src dest

[Taruchit]

Hi @alexspunkshell,

Please confirm if I understood your requirement correctly: -

There are two fields in the result: - src and dest.

If in a given row both src and dest are same, then you need to filter out those rows from the result.

Thank you

[alexspunkshell]

@Taruchit  You are right.