medium10 pts · first answer countssiemsplunkspl

What dedup user keeps

An analyst wants every source IP that each user logged in from today. Why is this search wrong?

index=auth action=success
| dedup user
| table _time user src_ip

A.dedup keeps one event per user, so other IPs are lostB.dedup removes users who logged in only once todayC.table cannot show the _time field in its outputD.action=success also matches failed logins

Discussion 0

Join free to post in the discussion.

What dedup user keeps

Discussion 0

Related questions