Splunk Search

InputLookup - find unique values across 4 fields

brdr
Contributor

I have a lookup file that contain 4 fields (field1, field2, field3, field4) which contains an account number. Same account number can exist across the different fields as well as unique account numbers in these fields. I need a search that provides a count of unique account numbers across the 4 fields (and as a separate list of events).

0 Karma

somesoni2
Revered Legend

Try this

| inputlookup yourlookup.csv | table field1 field2 field2 field4 | eval temp=1
| untable temp field AccountNumber
| stats dc(AccountNumber) as UniqueAccountNumbers
0 Karma

brdr
Contributor

Nice. Will try it out. Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...