Hi everyone, I am new to splunk. I am looking at windows event logs for the EventCode=4725 for all usernames within a week's timeframe. What I want is to remove username results if there are more than 1 count for this eventcode including that username, and then list in a table to show the timestamp and username when the eventcode occurred. Example: Usernames with EventCode=4725 recorded within 1 week: Day 1 10pm : anna Day 1 11pm : betty Day 3 10pm : anna Day 3 1pm : charlie Day 7 2pm : zach Final result I want is: Day 1 11pm : betty Day 3 1pm : charlie Day 7 2pm : zach From the above we have 'anna' removed completely from as her event showed up more than once. This is my original query: index=wineventlog EventCode=4725 | fields * | eval timestamp=strftime(_time, "%Y-%m-%dT%H:%M"%S") | stats count by username | where username = 1 I then realised the problem with using stats count by, because I wouldnt be able to show the timestamp for the results result this is in statistics. I have thought of using dedup to remove duplicate values, but I have not found a way to remove duplicate values including that value itself. Please help. Thank you
... View more