Splunk Search
Highlighted

Summarize IDs from several log entries

New Member

Hey,

i have a Firewall Log and want to count the sending/receiving domains.
My problem is that there is for one email three or more log entrys.
Each message has a uniqe ID, which is available in every associated log entry.
Is it possible to merge these, so that i dont count an email twice or more.

Thank you 🙂

My current search looks like this:

| rex field=_raw "to=<(?[\w\d\.\-]+\@(?[\d\w\.\-]+)\>)" 
| stats count(domain2) AS Anzahl by domain2 
| rename domain2 AS "Domain Outgoing Anzahl" 
| sort - Anzahl 
| head 50
Tags (2)
0 Karma
Highlighted

Re: Summarize IDs from several log entries

SplunkTrust
SplunkTrust

Try this query.

| rex field=_raw "to=<(?[\w\d\.\-]+\@(?[\d\w\.\-]+)\>)" 
| dedup uniqueID
| stats count(domain2) AS Anzahl by domain2 
| rename domain2 AS "Domain Outgoing Anzahl" 
| sort 50 - Anzahl 
---
If this reply helps you, an upvote would be appreciated.
0 Karma