Splunk Search

Using Dedup by location?

Path Finder

Hi,

Right now my code is: | stats earliest(_time) as first_login latest(_time) as last_login by IP_address User
| eval term=last_login-first_login
| eval term=case(term>(86400*7), "Long", term>86400 AND term<(86400*7), "Short", term<86400, "Very Short")
| iplocation IP_address
| where (isnotnull(Country) AND isnotnull(City) AND NOT Country="United States" AND trim(Country)!="" AND trim(City)!="")
| stats dc(User) AS usercount by Country City term User
| dedup User
| eval temp=Country."##".City
| chart sum(usercount) over temp by term
| rex field=temp "(?.+)##(?.+)"
| table Country City "Very Short" Short Long

I thought it was working the way I wanted to, but then through some cross-checking I noticed it's deduplicating the User globally, and my intentions are for it to only dedup it by the Country, or Country/City if that makes sense..

So if someone logs in Shanghai, China as "Very Short" and then logs in from Wuhan, China as "Very Short" (within the last 30 days), it's only counting the Shanghai login.

I've done some playing around with where I put the Dedup, but I can't seem to make any real headway.

Any guidance is appreciated.

0 Karma
1 Solution

Influencer

Try this

| dedup User Country City 

This will remove any duplicate occurences of the User Country City combination

View solution in original post

Influencer

Try this

| dedup User Country City 

This will remove any duplicate occurences of the User Country City combination

View solution in original post

Path Finder

This seems to do what I was looking for! Such a simple fix haha, thank you!

0 Karma