×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
tullir
New Member
Member since: ‎02-23-2019
‎06-05-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎02-23-2019
Activity Feed
View All

Re: I need to group events that have the same date...

by in Splunk Search
‎02-23-2019 09:17 AM
‎02-23-2019 09:17 AM
Thanks Rich!! I was thinking of adding the value corX to all the entries where IP address=ip address and time=time. This was I could list all the cor's found and analyze from there? ... View more

Re: I need to group events that have the same date...

by in Splunk Search
‎02-23-2019 08:20 AM
‎02-23-2019 08:20 AM
I'm thinking I need to correlate the events some how? Would want the output to show something like 12:01 1.1.1.1 oneuser 9839 1 corA 12:02 2.3.4.5 oneuser 8211 3 12:04 1.1.1.1 threeuser 9222 4 ... View more

I need to group events that have the same date and...

by in Splunk Search
‎02-23-2019 07:09 AM
‎02-23-2019 07:09 AM
HI folks! I need to group by two variables but am having trouble figuring it out. time ip_address user eventid sizesent 12:01 1.1.1.1 oneuser 9839 1 12:01 1.1.1.1 twouser 7382 2 12:02 2.3.4.5 oneuser 8211 3 12:04 1.1.1.1 threeuser 9222 4 That's an example of my data and I want to group the time stamp and the ip address. Basically, if time=time and ip_address=ip_address, combine them and, preferably, take the highest value of sizesent. I tried dedup but that gets rid of vital information. Any help would be appreciated! ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM