Splunk Search

How to use dedup on a field, but aggregate all other values in another field?

Presh
New Member

I am running a search to identify all users and the URLs they have connected to. The result includes duplicate users, but different URLs. I would like to dedup the users field, but have it list all URLs each user as connected to.

The results currently look like this:

User       URLS
Mak        Cnn.com
Mak        Google.com
Mak        Yahoo.com
Bam        Aljazeera.com
Bam        BBC.com

I would like it to look like this;

User       URLS
Mak        Cnn.com
           Google.com
           Yahoo.com
Bam        Aljazeera.com
           BBC.com

I hope this makes sense.

The current search is .... | table user src_user. If I use the dedup value against the src_user, I lose all the URLs except for one that associates with each user returned in the dedup function.

Thanks,

0 Karma
1 Solution

javiergn
Super Champion
| yourquery
| stats list(URLS) as URLS by User

View solution in original post

0 Karma

javiergn
Super Champion
| yourquery
| stats list(URLS) as URLS by User
0 Karma

javiergn
Super Champion

Note that list won't do dedup on URLs, you can use values instead if you want this to happen:

| inputcsv mycsv.csv
| stats values(URLS) as URLS by User
0 Karma

Presh
New Member

Thanks Javiergn, it works.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...