How to use stats dc and get last time of occurrence?

[dieguiariel]

Hi! im trying to detect multiple user access from the same source (same mobile device). Im feeding splunk with logs from a mobile app like this:

09:50:14,524 INFO [XXXXXXXXXXXX] (default task-XXXXXX) [ authTipoPassword=X, authDato=XXXXX, authTipoDato=X, nroDocEmpresa=X, tipoDocEmpresa=X, authCodCanal=XXX, authIP=XXX.XXX.XXX.XXX, esDealer=X, dispositivoID=XXXXXXXXXX, dispositivoOS=XXXXX ]

im using the following search

search XXXX |  stats dc(authDato) as count,values(authDato) as AuthDato by dispositivoID dispositivoOS authIP | where count > 1 | sort - count 

and get almost all the info i wanted (like two different users - authDato - from same deviceID (dispositivoID), but i would like to enrich the data with the last time of ocurrence for the event.

Is there a way to include this information? 

Thanks in advance.

[dieguiariel]

Thanks! how can i get the value of "latest" on the results?

The table shows only

dispositivoID dispositivoOS authIP Country City count AuthDato

is it possible to get the latest time next to AuthDato?

[gcusello]

Hi @dieguiariel,

latest is the value of the timestamp of the latest event of each group of values.

If you don't see it in your results, please share your search because, using my search it's present.

Ciao.

Giuseppe

[dieguiariel]

hi sorry i didnt explain myself correctly, it shows the lasttime of lastocurrence of the grouped events, but i will like to show the last time of ocurrence of every item on the grouped list like this:

include the lastest time of ocurrence for 3546316, the latest time of 6320818 and so on.

dispositivoID dispositivoOS authIP count AuthDato latest

062FC4DB-034D-4CA3-B6BD-72C5A471F0AA

iOS

XXX.XXX.XXX.XXX

3

3546319 6320818 7154705

2023-01-31 18:59:37 2023-01-31 17:45:36 2023-01-31 16:32:24

[gcusello]

Hi @dieguiariel,

you could add the latest option to ths tats command:

search XXXX 
|  stats 
   dc(authDato) AS count
   values(authDato) AS AuthDato 
   latest(_time) AS latest
   BY dispositivoID dispositivoOS authIP 
| where count > 1 
| sort - count 
| eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S")

Ciao.

Giuseppe