topic Re: How to create a stats count by aggregating multiple fields? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-a-stats-count-by-aggregating-multiple-fields/m-p/350234#M103708 <P>You can try something like this, though there may be a more efficient way to do it.</P> <PRE><CODE>&lt;Base Search&gt; | eval addr=saddr+":"+daddr | makemv delim=":" addr | mvexpand addr | stats count by addr </CODE></PRE> <P>Basically, you combine the source and destination addresses together and make that a multi-valued field, expand out those values so there's an event for each value, then use stats to group by those new values.</P> Tue, 30 Jan 2018 20:31:45 GMT traxxasbreaker 2018-01-30T20:31:45Z How to create a stats count by aggregating multiple fields? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-stats-count-by-aggregating-multiple-fields/m-p/350233#M103707 <P>How do you create a stats count after aggregating multiple fields into one?</P> <P>Example: Given the following table:</P> <TABLE><THEAD> <TR> <TH>index</TH> <TH>saddr</TH> <TH>daddr</TH> </TR> </THEAD><TBODY> <TR> <TD>A</TD> <TD>10.0.0.1</TD> <TD>192.168.1.8</TD> </TR> <TR> <TD>A</TD> <TD>10.0.0.1</TD> <TD>192.168.1.9</TD> </TR> </TBODY></TABLE> <P>How can I get a table like the following?</P> <TABLE><THEAD> <TR> <TH>index</TH> <TH>addr</TH> <TH>count</TH> </TR> </THEAD><TBODY> <TR> <TD>A</TD> <TD>10.0.0.1</TD> <TD>2</TD> </TR> <TR> <TD>A</TD> <TD>192.168.1.8</TD> <TD>1</TD> </TR> <TR> <TD>A</TD> <TD>192.168.1.9</TD> <TD>1</TD> </TR> </TBODY></TABLE> Tue, 30 Jan 2018 20:19:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-stats-count-by-aggregating-multiple-fields/m-p/350233#M103707 dkotowsk 2018-01-30T20:19:01Z Re: How to create a stats count by aggregating multiple fields? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-stats-count-by-aggregating-multiple-fields/m-p/350234#M103708 <P>You can try something like this, though there may be a more efficient way to do it.</P> <PRE><CODE>&lt;Base Search&gt; | eval addr=saddr+":"+daddr | makemv delim=":" addr | mvexpand addr | stats count by addr </CODE></PRE> <P>Basically, you combine the source and destination addresses together and make that a multi-valued field, expand out those values so there's an event for each value, then use stats to group by those new values.</P> Tue, 30 Jan 2018 20:31:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-stats-count-by-aggregating-multiple-fields/m-p/350234#M103708 traxxasbreaker 2018-01-30T20:31:45Z