Splunk Search

help with search repeated events with diffrent values in specific field

jacob_rod
Explorer

Hello,

Help will be very appreciated.

My splunk index contains a field with codes, and another field with names.

Every event contains a code and a name.

1. I need to display all the codes that repeat more then once and have different names -  result for example can be code 444 that apear with two names dave and miriam.

2.Farther more, I need to display codes that have events with two specific names.

Thank you,

Jacob

 

Labels (2)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

1. This should show all the codes that have more than one name associated with them.

... | stats values(name) as names by code
| where mvcount(names) > 1

2. Here is one way to find the codes with two specific names

index=something (name="foo" OR name="bar")
| stats values(code) as codes by name
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

jacob_rod
Explorer

This is my final search -

index=something (name="foo" OR name="bar")
| eval timeValue = strptime(Date, "%Y-%m-%d %H:%M")
| eval earliest = strptime("2021-02-17 08:00", "%Y-%m-%d %H:%M")
| where (timeValue > earliest)
| stats values(name) as names by code
| where mvcount(names) > 1
| table code names

Trying to add field from the events to the table came out empty...

Question is how can I add a field from the events to the table ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

1. This should show all the codes that have more than one name associated with them.

... | stats values(name) as names by code
| where mvcount(names) > 1

2. Here is one way to find the codes with two specific names

index=something (name="foo" OR name="bar")
| stats values(code) as codes by name
---
If this reply helps you, Karma would be appreciated.
0 Karma

jacob_rod
Explorer

Thank you very much, using the two solutions together solved my issue.

How can I add Time filter to the evens ?

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What exactly do you mean by "time filter"?  What results do you want?

---
If this reply helps you, Karma would be appreciated.
0 Karma

jacob_rod
Explorer

Hi,

My time field name is "time_start" - structure is -  2020-12-22T10:40:04.327+04:00

I need to display events from specific time boundaries (starting specific time until end time)

this is together with the code & name filters above.

Thank you again for the help.

Jake

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your events should already be mapping time_start to _time so filtering them should be a matter of selecting the desired time range from the time picker.

If you don't map time_start to _time then you'll have to filter in your query.

index=something (name="foo" OR name="bar")
| eval startTime=strptime(time_start, "%Y-%m-%dT%H:%M:%S%:z")
| where startTime ```fill in conditions```
| stats values(code) as codes by name
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...