Eval count event field

arbero — Wed, 17 May 2017 09:53:30 GMT

Hello Community

I'm new with splunk and I need your help.

I have for example the following output (events):

COL_A       COL_B       COL_ID
row1        row1        1
row2        row2        2
row3        row3        1
row4        row4        3
row5        row5        1
row6        row6        2

What I want, is to add a new field to count them by the occurrence of their ID (col_id):

COL_A       COL_B       COL_ID      occurred
row1        row1        1           3
row2        row2        2           2
row3        row3        1           3
row4        row4        3           1
row5        row5        1           3
row6        row6        2           2

Is there a way to do this?

Br,
Arber

Re: Eval count event field

woodcock — Wed, 17 May 2017 12:10:47 GMT

Like this:

| makeresults | eval raw="row1 row1 1::row2 row2 2::row3 row3 1::row4 row4 3::row5 row5 1::row6 row6 2"
| makemv delim="::" raw
| mvexpand raw
| fields - _time
| rex field=raw "^(?<COL_A>\S+)\s+(?<COL_B>\S+)\s+(?<COL_ID>\S+)$"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| eventstats count AS occurred BY COL_ID

topic Re: Eval count event field in Splunk Enterprise

Eval count event field

Re: Eval count event field