Splunk Search

How to search a query based on the result of another query?

krishman23
Explorer

I have list of events that have IP address

{
USERID: system01
browser: Chrome,
ip: 192.168.10.10
...}
{
USERID: system03
browser: Chrome,
ip: 192.168.10.10
...}
{
USERID: system02
browser: Chrome,
ip: 192.168.11.10
...}
I want to get the events that has the number of ip only once
the output should only be
{
USERID: system01
browser: Chrome,
ip: 192.168.11.10
...}
as 192.168.10.10 is repeated twice it should be eliminated.

Tags (2)
0 Karma
1 Solution

pradeepkumarg
Influencer

If you have IP address extracted into a field, let's say IP. You can append following to your search.


|eventstats count by IP | search count < 2

View solution in original post

0 Karma

pradeepkumarg
Influencer

If you have IP address extracted into a field, let's say IP. You can append following to your search.


|eventstats count by IP | search count < 2

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!