Highlighted
Contributor.
Contributor.
1082 views

Get unique values from an active channel

Hey all 🙂

I would like to know how can I get uniques values from an active channel.

For example, I made an active channel that shows logon logs from an IP address, but the results contain many users. I want to see only 1 event per user. 

One solution to this problem is through the "inline filter", it is possible to press the drill down arrow and see the results uniquely. However, the results only loads up when you scroll down and see an event with such a result. For instance, I can press the drill down arrow and see some users that logged in, and then scroll down the active channel and see more users afterwards.

0 Likes
2 Replies
Highlighted
Honored Contributor.
Honored Contributor.

... a workaround might be to use a query and a query viewer to get unique results. (but I'm afraid that's not what you where looking for (and you probably know that queries/query viewers can do this)).

0 Likes
Highlighted
Outstanding Contributor.
Outstanding Contributor.

Hi 

If your on ESM versions 6.5 and above the fastest way will be to use the command centers (the web console) event search search to display uniqe values of fields

for example use the following search synatx

deviceVendor = "Microsoft" AND deviceAddress = "10.0.0.1" | dedup sourceUserName

To get all of the unique sourceUserNames 

 

Attached are a few screenshots

command.pngCapture.PNG 

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.