topic Re: aggregating stats by wildcard or arbitrary number of fields in Splunk Search

aggregating stats by wildcard or arbitrary number of fields

mikesherov — Fri, 31 Aug 2012 12:45:04 GMT

Imagine I have the following data:

msg     uid      AB_test1     AB_test2
click   1        A            A
reqst   2        B            A
click   3        B            B
reqst   4        A            B
click   5        B            A
reqst   6        B            A
click   7        A            A
reqst   8        A            B

I want to do a stats query aggregating the results of my various AB tests for the "click" msg. I can do this:

msg="click" | stats count by AB_test1, AB_test2

But imagine I now have AB_test3 through AB_test10 or a variable number of tests running at once. I don't want to have to do this:

msg="click" | stats count by AB_test1, AB_test2, ... AB_test10

I'd like to do something similar to this:

msg="click" | stats count by AB_*

Is this possible, or is there some similar syntax that essentially groups data by an arbitrary set of fields?

Re: aggregating stats by wildcard or arbitrary number of fields

jonuwz — Fri, 31 Aug 2012 15:11:20 GMT

I'm pretty sure that this technique will fall apart if you want to do anything more complicated, but ..

| inputlookup example.csv | fields - uid | search msg="click" | stats count(AB*) | transpose | rex field=column ^count\((?<column>.*?)\) | rename column as field | rename "row 1" as count

returns

field   count
AB_test1    4
AB_test2    4

Re: aggregating stats by wildcard or arbitrary number of fields

lguinn2 — Fri, 31 Aug 2012 15:17:12 GMT

I suppose that there is no hope of transforming the data into this format:

msg uid testName testResult

click 1 test1 A

click 1 test2 A

BTW, it would be nice if you could wildcard the stats command as you showed! But you can't, and I can't see any other easy way to do what you want.