topic Re: How to get count by unique value? in Splunk Search

How to get count by unique value?

vel4ever — Tue, 14 Apr 2020 01:36:49 GMT

Hi,

I am new to Splunk. I have below log which is capturing product id,

Header product-id, 12345678900
Header product-id, 12345678901
Header product-id, 12345678900

I would like to group by unique product id and count,

12345678900 2
12345678901 1

Here product-id is not a field in splunk. How can write a query for this?

jpolvino — Tue, 14 Apr 2020 02:35:39 GMT

If your log is literally lines like Header product-id, 12345678900 then you can extract the last value (assuming all digits) and stats-by on that.

Example:

(your search)
| rex "Header product-id, (<productId>\d+)"
| stats count by productId

If this doesn't work, please post the actual events you get back and I'm sure people here can help!

harishalipaka — Tue, 14 Apr 2020 10:44:00 GMT

hi @vel4ever

try this

| makeresults 
 | eval raw="Header product-id, 12345678900" 
 |eval ID=mvindex(split(raw," "),-1) |stats count by ID

vel4ever — Tue, 14 Apr 2020 16:55:00 GMT

I am getting error while running this query. And product-id could be decimal value too, ex: 123.4567.8900. Thanks

vel4ever — Tue, 14 Apr 2020 16:55:27 GMT

I am not getting any results for this query. Thanks.

manjunathmeti — Tue, 14 Apr 2020 17:22:00 GMT

Use rex command.

 | rex "product-id,\s(?<product_id>[\d\.]+)" | stats count by product_id