Splunk Search

Missing original value after using distinct query

New Member

I am having the following issue that need your help.
The scenario is: I am working on the report of firewall data in Splunk. The requirement is getting the distinct destination connected by source address. The table should contain: Source Address, Destination Address and Distinct count the number of Destination address connected by Source.
I am trying to use the dc query to get the distinct count for destination address but when doing table, i only can get source and distinct count number but the destination address value is missing.
Here is the query that I am using:

| dedup src dest | stats dc(dest) as
Count by src | table src dest Count |
sort src

Below is the output of the query:
alt text

Please help to suggest what query should I use to retain the destination address value.

Tags (1)
0 Karma


@michaelhoang ,


| stats dc(dest) as Count,values(dest) as dest by src


    | stats dc(dest) as Count  by src,dest|eventstats sum(Count) as Count by src
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...