Splunk Search

Return values of field that dc is ran on instead of just the count

trc29
Engager

Hello all,

I have the following search:

index="vpn_gateway" eventtype="vpn-authall" |
stats dc(vpnuid) by vpnclient |
search "dc(vpnuid)" > 1 |
fields vpnclient, dc(vpnuid) |
sort -dc(vpnuid)

This command searches our VPN index for any authentication events, counts them by source IP addresses, and if a particular IP has signed in on 2 or more accounts, the IP address and number of users is returned:

vpnclient | dc(vpnuid)

10.0.8.1 | 2
10.0.2.2 | 3

What I'd like to do is also include the ID of the users. The output should look as follows:

vpnclient | dc(vpnuid) | userid
10.0.8.1 | 2 | jsmith, smatthews
10.0.2.2 | 3 | bcarol, jjefferson,jsmith

Is this possible? I'm at a loss.

Tags (2)
0 Karma

adonio
Ultra Champion

try this:

index="vpn_gateway" eventtype="vpn-authall" 
| stats dc(vpnuid) values(userid) as unique_user_ids by vpnclient
| search "dc(vpnuid)" > 1
| fields vpnclient, dc(vpnuid) unique_user_ids
| sort -dc(vpnuid)

you dont really need the fields command there as stats brings back only the fields you are "statsing"

hope it helps

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...