Multiple results

[SN1]

hello i have this search

| inputlookup lkp-all-findings
| lookup lkp-findings-blacklist.csv blfinding as finding OUTPUTNEW blfinding
| lookup lkp-asset-list-master "IP Adresse" as ip OUTPUTNEW Asset_Gruppe Scan-Company Scanner Scan-Location Location "DNS Name" as dns_name Betriebssystem as "Operation System"
| lookup lkp-GlobalIpRange.csv 3-Letter-Code as Location OUTPUTNEW "Company Code"
| dedup finding, dns_name, ip
| stats values("Company Code") as "Company Code" by finding, dns_name, ip, Asset_Gruppe, Scan-Company, Scanner, Scan-Location, Location, Betriebssystem

now this is the result.

now i have tried mvexpand , stats as well but it gives multiples values. The problem is let say for NessusHost "slo-svenessus01.emea.durr.int" there are let say 20 nessus host with this name now it is duplicating 20 "company code " (HHDE) in every single field for each Nessushost with this name and same for others as well.

[ITWhisperer]

This result doesn't look like the output of the search you shared, the values aggregation function already does a dedup i.e. you should only have unique values in the field, and the fields listed in the by clause of the stats command would appear first. Please clarify what your search was and the output you got from it.

[SN1]

Oh yes , sorry I gave wrong search . This is the seach

| inputlookup lkp-all-findings
| lookup lkp-findings-blacklist.csv blfinding as finding OUTPUTNEW blfinding
| lookup lkp-asset-list-master "IP Adresse" as ip OUTPUTNEW Asset_Gruppe Scan-Company Scanner Scan-Location Location "DNS Name" as dns_name Betriebssystem as "Operation System"
| lookup lkp-GlobalIpRange.csv 3-Letter-Code as Location OUTPUTNEW "Company Code"
| eval is_solved=if(lastchecked>lastfound OR lastchecked == 1,1,0),blacklisted=if(isnull(blfinding),0,1),timeval=strftime(lastchecked,"%Y-%m-%d")
| fillnull value="NA" "Company Code", Scan-Location
| search is_solved=0 blacklisted=0 Scan-Location="*" "Company Code"="*" severity="high"
| fields "Company Code" timeval ip dns "Operation System" severity pluginname timeval Scan-Location is_solved blacklisted
| sort severity

[ITWhisperer]

| inputlookup lkp-all-findings
| lookup lkp-findings-blacklist.csv blfinding as finding OUTPUTNEW blfinding
| lookup lkp-asset-list-master "IP Adresse" as ip OUTPUTNEW Asset_Gruppe Scan-Company Scanner Scan-Location Location "DNS Name" as dns_name Betriebssystem as "Operation System"
| lookup lkp-GlobalIpRange.csv 3-Letter-Code as Location OUTPUTNEW "Company Code"
| eval is_solved=if(lastchecked>lastfound OR lastchecked == 1,1,0),blacklisted=if(isnull(blfinding),0,1),timeval=strftime(lastchecked,"%Y-%m-%d")
| fillnull value="NA" "Company Code", Scan-Location
| search is_solved=0 blacklisted=0 Scan-Location="*" "Company Code"="*" severity="high"
| stats values("Company Code") as "Company Code" by timeval ip dns "Operation System" severity pluginname timeval Scan-Location is_solved blacklisted
| fields "Company Code" timeval ip dns "Operation System" severity pluginname timeval Scan-Location is_solved blacklisted
| sort severity

[SN1]

After running the search the "Company Code " field is empty

[ITWhisperer]

Sorry, try with double quotes around "Company Code" in the values function

| stats values("Company Code") as "Company Code" by timeval ip dns "Operation System" severity pluginname timeval Scan-Location is_solved blacklisted

[SN1]

result is coming but the ones with similar names are not coming . where in  dns field similar fields are not coming.

[ITWhisperer]

So, the "Company Code" problem is solved, but now you have another problem? Please share more specifics?

[gcusello]

Hi @SN1 ,

you coult to use mvdedup:

| inputlookup lkp-all-findings
| lookup lkp-findings-blacklist.csv blfinding as finding OUTPUTNEW blfinding
| lookup lkp-asset-list-master "IP Adresse" as ip OUTPUTNEW Asset_Gruppe Scan-Company Scanner Scan-Location Location "DNS Name" as dns_name Betriebssystem as "Operation System"
| lookup lkp-GlobalIpRange.csv 3-Letter-Code as Location OUTPUTNEW "Company Code"
| dedup finding, dns_name, ip
| stats values("Company Code") as "Company Code" by finding, dns_name, ip, Asset_Gruppe, Scan-Company, Scanner, Scan-Location, Location, Betriebssystem
| eval "Company Code"=mvdedup("Company Code")

Ciao.

Giuseppe