Splunk Search

Why is it showing more data after dc count with the right order?

dieguiariel
Path Finder

Hi! im working on an alert for access from different countries for certain users in a short time period. The alert and the search works fine but i will like to show more info when the alert triggers (source ip and time).

 

Here a sample of the event:

09:09:55,377 INFO [XX.XXX.XXXXXXX.cbapi.dao.login.LoginDAOImpl] (default task-34878) Enviamos parámetros: [authTipoPassword=E, authDato=4249929, authTipoDato=D, nroDocEmpresa=80097256-2, tipoDocEmpresa=D, authCodCanal=999, authIP=45.170.128.191, esDealer=N, dispositivoID=40ee57e1-e5eb-4b14-b7ef-9f0f8ccdf6c

2, dispositivoOS=null ]

Here the search:

index="XXXX" host="XXX.XXX.-*" sourcetype=XXXXXXCBAPI*  authDato authIP dao.login.LoginDAOImpl authIP=* authCodCanal=999 | iplocation authIP | eval Country = if(isnull(Country) OR Country="", "Unknown", Country) | stats
dc(Country) AS count
values(Country) AS country values(authIP) as authIP
latest(_time) AS latest
BY authDato | where count > 1 | eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S") | sort - latest

With this i get a result like this:

authdato | count | Country | authIP | latest

2363494 | 2 |   Argentina | 170.51.250.39 | 2023-03-15 09:09:09

                              Paraguay | 170.51.55.186

the thing is.. the ip address aren't aligned with the country for that ip, neither the time is aligned with the last Country or ip address.

Ive tried several things but still can't figure out how to correctly present the results (in the right order i mean)

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use list() rather than values() - values() will put the values in (lexicographical) order and removes duplicates, whereas list() maintains the order and duplicates.

View solution in original post

dieguiariel
Path Finder

Hi! thank yoy both for the answer, it worked with list! 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use list() rather than values() - values() will put the values in (lexicographical) order and removes duplicates, whereas list() maintains the order and duplicates.

richgalloway
SplunkTrust
SplunkTrust

The values function returns unique values of a field in alphabetical order.  You can't change that.

Try the list function, instead, which return all values in the order they were found.  Only 100 values are returned, however.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...