Splunk Search

How to search a query based on the result of another query?

New Member

I have list of events that have IP address

{
USERID: system01
browser: Chrome,
ip: 192.168.10.10
...}
{
USERID: system03
browser: Chrome,
ip: 192.168.10.10
...}
{
USERID: system02
browser: Chrome,
ip: 192.168.11.10
...}
I want to get the events that has the number of ip only once
the output should only be
{
USERID: system01
browser: Chrome,
ip: 192.168.11.10
...}
as 192.168.10.10 is repeated twice it should be eliminated.

Tags (2)
0 Karma
1 Solution

Influencer

If you have IP address extracted into a field, let's say IP. You can append following to your search.


|eventstats count by IP | search count < 2

View solution in original post

0 Karma

Influencer

If you have IP address extracted into a field, let's say IP. You can append following to your search.


|eventstats count by IP | search count < 2

View solution in original post

0 Karma