topic Re: How do I show more fields after the stats count by command? in Splunk Search

How do I show more fields after the stats count by command?

jcolon68 — Thu, 23 May 2019 20:42:42 GMT

I need to add more columns to a search after results are counted. Here's my query

index=wineventlog EventCode=4740 host=* | stats count by Account_Name | sort - count

Results give me Account_Name and Count ...I want to add more fields to results.I tried table but this doesn't work.

Re: How do I show more fields after the stats count by command?

aguthrie1190 — Thu, 23 May 2019 20:49:10 GMT

index=wineventlog EventCode=4740 host=* | stats count by Account_Name Field1 Field2 | sort - count

That should add Field1 and Field2 to your results

Re: How do I show more fields after the stats count by command?

jcolon68 — Thu, 23 May 2019 20:56:01 GMT

Thanks! I tried that , but the count is not correct. It's only showing count as 1 for most of the results when there's multiple.

Re: How do I show more fields after the stats count by command?

aguthrie1190 — Thu, 23 May 2019 21:03:27 GMT

When you do count by, stats will count the times when the combination of fields appears together, otherwise it will throw away the field if it is not specified in your by argument.

Say you have this data

1 host=host1 field="test"
2 host=host1 field="test2"

And my search is:
* | stats count by host field

I'll have 2 results, each with the count of 1. One result for host1, test and one result for host1, test2.

What does your data look like, if you have a lot of unique events, stats may not be the best way to characterize your data.

Re: How do I show more fields after the stats count by command?

Vijeta — Thu, 23 May 2019 21:24:39 GMT

@jcolon68 try below

index=wineventlog EventCode=4740 host=* | stats values(*) as * , count by Account _Name|sort 0 count

Re: How do I show more fields after the stats count by command?

mtranchita — Fri, 24 May 2019 00:28:25 GMT

When you pipe to stats you are doing a transforming search and in effect dropping the data that isn't part of the statistical results.
In order to include additional fields you need to include them as part of the results. You could also try something like appendpipe to add more output to your base search.

References:
https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutreportingcommands
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendpipe

Re: How do I show more fields after the stats count by command?

jcolon68 — Fri, 24 May 2019 13:18:50 GMT

I just really want to group the Account_Name field into individual lines with a count. But I want to see multiple fields, like Computer Name , which may be different for example:

Account_Name Computer name IP
account Computer 1 10.10.0.1
account Computer 2 10.10.0.2
account Computer 3 10.10.0.3

what I'd like to see is just a grouping and count of "Account_Name" and show other fields as well:

Account_Name Computer name IP Count
account Computer 1 10.10.0.1 3
account Computer 2 10.10.0.2 3
account Computer 3 10.10.0.3 3

Re: How do I show more fields after the stats count by command?

mkolkebeck — Fri, 24 May 2019 13:50:12 GMT

You could try using the eventstats command instead of stats.

Per Splunk Docs,

The eventstats command is similar to the stats command. The difference is that with the eventstats command aggregation results are added inline to each event and added only if the aggregation is pertinent to that event.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventstats

Re: How do I show more fields after the stats count by command?

somesoni2 — Fri, 24 May 2019 14:37:40 GMT

What's your requirement here? Could you please provide available fields and sample expected
output?

Re: How do I show more fields after the stats count by command?

mtranchita — Wed, 30 Sep 2020 00:40:09 GMT

So you want to count the account names by multiple fields while still showing the account name?
Have you tried something like:
index=wineventlog EventCode=4740 host=* | stats c(Account_Name) as COUNT by Account_Name, ComputerName, IP

Re: How do I show more fields after the stats count by command?

khiott — Wed, 28 Oct 2020 01:10:51 GMT

index=wineventlog EventCode=4740 host=* | stats count by Account_Name, Computer_Name, IP | stats list(Computer_Name) as Computer_Name, list(IP) as IP, count(Account_Name) as Count by Account_Name | sort - Count

@jcolon68, this groups Account_Names together and still counts them.