- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Dedup reporting engine results for top 100 User Agents?
I'm wondering if anyone has attempted to dedup specific meta like user.agents from IIS logs in the reporting engine of NetWitness?XDudADtNBir2yWTvsAvML3S8A4BmZKPAABc5iGXZy0M= TnCNqFbwCBwNT2aUaQOZPvE3tSL3jJyeOvABeYMBjJM=
I can use aggregates like distinct, which gives me a count, but I need the actual values.
In the above example I expect the bottom 100 results (thus Ascending) order. However what RE returns is a ton of instances where user.agent = '-' for instance. Not deduping the results.
Is there a method where I can do this in the Then clause for instance?
I went through all the docs I have but cannot locate anything that is helpful here.
My end goal is to take this "sample" data over a period of time and compare it to some larger dataset just to get a very rough estimate of rare user agent string increases over a sustained period of time. (Yes I realize this metric is a tad meaningless but I have to start somewhere).
Thanks for your help/ideas!
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
FYI - Following up to this, as I have no clue how to get what I needed, I ended up exporting all the data without using unique and provided a sample export of the metadata values in .csv format to my data science team for analysis.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
FYI - Following up to this, as I have no clue how to get what I needed, I ended up exporting all the data without using unique and provided a sample export of the metadata values in .csv format to my data science team for analysis.
