Splunk Search
Highlighted

Using dedup with multiple fields

Contributor

I can do the following separately, and I get the results I want.

index="wineventlog" EventIdentifier="4624" | dedup ComputerName
index="wineventlog" EventIdentifier="4688" AND (New_Process_Name="*word.exe*" OR New_Process_Name="*excel.exe*" OR New_Process_Name="*outlook.exe*") | dedup New_Process_Name

I'm having trouble combining the two.

Tags (2)
0 Karma
Highlighted

Re: Using dedup with multiple fields

Legend

What results are you looking for?

0 Karma
Highlighted

Re: Using dedup with multiple fields

Legend

did you tried with the "append" command?
Bye.
Giuseppe

Highlighted

Re: Using dedup with multiple fields

Contributor

Just now got append working.

0 Karma
Highlighted

Re: Using dedup with multiple fields

Legend

index="wineventlog" EventIdentifier="4624" | dedup ComputerName
| append [ search index="wineventlog" EventIdentifier="4688" (NewProcessName="word.exe" OR NewProcessName="excel.exe" OR NewProcessName="outlook.exe") | dedup NewProcessName]

are you sure that the searches have results? I trided on my Splunk and I have the addition of the two searches

Bye.
Giuseppe

0 Karma
Highlighted

Re: Using dedup with multiple fields

Contributor

They did. As I said in my OP, both searches on their own produce results.

0 Karma
Highlighted

Re: Using dedup with multiple fields

Explorer

use comma to combine multiple dedup fields .

dedup ComputerName,NewProcess_Name

Highlighted

Re: Using dedup with multiple fields

Contributor

Same results as using woodcock's answer. I only get results for event 4688.

0 Karma
Highlighted

Re: Using dedup with multiple fields

Esteemed Legend

It really depends on what you are trying to do (your question is too vague). Try this:

index="wineventlog" EventIdentifier="4624" | dedup ComputerName
| append [ search
   index="wineventlog" EventIdentifier="4688" AND (New_Process_Name="*word.exe*" OR New_Process_Name="*excel.exe*" OR New_Process_Name="*outlook.exe*") | dedup New_Process_Name]

Or this:

 index="wineventlog" (EventIdentifier="4624" OR (EventIdentifier="4688" AND (New_Process_Name="*word.exe*" OR New_Process_Name="*excel.exe*" OR New_Process_Name="*outlook.exe*"))) | dedup ComputerName New_Process_Name

View solution in original post

Highlighted

Re: Using dedup with multiple fields

Contributor

As I said, I want to combine the two searches. I don't know how I can make it any more specific than that.

First throws an error ("unknown command index") and second only matches event 4688.

0 Karma