Making sense of stats results for 1 source to multiple destination

[neerajs_81]

Hi All, 
I have this simple search that shows logins from same SRC IP  to multiple Destination hosts.  Can someone pls explain why does dc(dest_ip) not match the # of values reported by values(dest) in the Results ?  You will notice in the results, that if values(dest) shows 2 hostnames then dc(dest) shows 4 .

Should't it be  that if dc(dest_ip) shows 4  then values(dest) should also report 4 unique host names?  What am i missing ?   Thanks

index=xxx source="WinEventLog:Security" EventCode=5140 
| stats  dc(dest_ip) as dest_count values(dest) values(Account_Name) values(user_first) values(user_last)by Source_Address
| rename values(*) as *

Results: 

Source_Address	dest_count	dest	Account_name	user_first	user_last
10.x.x.11	4	server01@domain.com server02@domain.com	xxxx	xxx	xxx
10.x.x.12	4	server01@domain.com server02@domain.com	xxxx	xx	xx
10.x.x.13	2	server03@domain.com	xxx	xx	xx

[gcusello · Accepted solution]

Hi @neerajs_81,

probably there's some dest that has more ips or some dest_ip haven't a dest.

try to add a new component for debugging:

index=xxx source="WinEventLog:Security" EventCode=5140 
| stats  dc(dest_ip) as dest_count values(dest_ip) as dest_ip_count values(dest) values(Account_Name) values(user_first) values(user_last)by Source_Address
| rename values(*) as *

Ciao.

Giuseppe

[neerajs_81]

Thanks. When you say some dest_IP don't have a dest meaning is it a case of  DNS entries missing for those IPs ?

[gcusello]

Hi @neerajs_81,

yes exactly, with the add-on to the search I hinted, you can see the values of dest_ip and the values of dest, so you can compare them.

You can also run a search with dest_ip=* and see if the dest field has 100% of results.

If you don't want to have an empty value for some dest, you could add to your search (before the stats command) a fillnull command:

| fillnull value="-" dest

 Ciao.

Giuseppe

[neerajs_81]

Yep makes sense . Thank you as always.