topic Count number of field value per source and show as table in Splunk Search

Count number of field value per source and show as table

christopheryu — Wed, 14 Mar 2018 18:30:32 GMT

I have a field named "router" that has multiple values and have three sources. I would like to count the router values for each source and put them in a table.

So the three "source" values are syslogs, enviro and triggers and "router" have multiple values (e.g, ABCD, EFGH, KLMN). I would like to put in a table the total count of distinct "router" value for each source as shown below:

router syslog enviro triggers
ABCD 3 4 8
EFGH 2 5 9
KLMN 3 7 8

thank you in advance!

Re: Count number of field value per source and show as table

493669 — Wed, 14 Mar 2018 18:35:24 GMT

try this:

...|stats values(router) as router values(*)as * by source

Re: Count number of field value per source and show as table

christopheryu — Wed, 14 Mar 2018 19:36:46 GMT

thank you for response but your suggestion showed all the fields and their values by source router.

Re: Count number of field value per source and show as table

christopheryu — Wed, 14 Mar 2018 19:55:48 GMT

this solved it:

| stats count by router source | xyseries router source count

but I would like to add another column that would show the total count, any suggestions?

Re: Count number of field value per source and show as table

niketn — Wed, 14 Mar 2018 20:33:48 GMT

@christopheryu try the following addtotals command will give you both row total and column total. You can turn off whichever you dont need by setting either row=f or col=f respectively. The labelfield and label arguments are used for column total.

<YourBaseSearch>
| stats count by router source
| xyseries router source count
| fillnull value=0
| addtotals row=t col=t labelfield=router label=Total

Re: Count number of field value per source and show as table

christopheryu — Wed, 14 Mar 2018 20:53:57 GMT

| appendcols [search | stats count as TOTAL by router] worked by I like yours better as it is faster 🙂 Thank you!