https://community.splunk.com/t5/Splunk-Search/Calculating-fields-by-groups-of-events/m-p/54699#M13338 <P>Hello,<BR /> I need to group events by 3 filelds ip,login and city (one group with same login,same ip and same city),<BR /> something like this<BR /> user1 192.168.1.1 London field4...fieldn<BR /> user1 192.168.1.1 London field4...fieldn<BR /> user1 192.168.1.1 London field4...fieldn</P> <P>user1 2.2.2.2 London field4...fieldn<BR /> user1 2.2.2.2 London field4...fieldn<BR /> ....<BR /> user10 4.4.4.4 NY field4...fieldn<BR /> user10 4.4.4.4 NY field4...fieldn<BR /> user10 4.4.4.4 NY field4...fieldn<BR /> after this i need to calculate custom fields INSIDE EVERY GROUP, for example sum of events in group with field4`s value=5 or minimal value of fieldn where field4=12.<BR /> I tried to use transaction command </P> <P>| transaction ip, login, city</P> <P>but I don`t find out how to calculate custom fileds separately for each transaction.</P> <P>Also, I was looking at stats command, but as I understood, it`s not possible to use eval command inside stats statement. </P> <P>What`s the best way to do it?</P> Thu, 07 Mar 2013 15:24:51 GMT andrey2007 2013-03-07T15:24:51Z https://community.splunk.com/t5/Splunk-Search/Calculating-fields-by-groups-of-events/m-p/54699#M13338 <P>Hello,<BR /> I need to group events by 3 filelds ip,login and city (one group with same login,same ip and same city),<BR /> something like this<BR /> user1 192.168.1.1 London field4...fieldn<BR /> user1 192.168.1.1 London field4...fieldn<BR /> user1 192.168.1.1 London field4...fieldn</P> <P>user1 2.2.2.2 London field4...fieldn<BR /> user1 2.2.2.2 London field4...fieldn<BR /> ....<BR /> user10 4.4.4.4 NY field4...fieldn<BR /> user10 4.4.4.4 NY field4...fieldn<BR /> user10 4.4.4.4 NY field4...fieldn<BR /> after this i need to calculate custom fields INSIDE EVERY GROUP, for example sum of events in group with field4`s value=5 or minimal value of fieldn where field4=12.<BR /> I tried to use transaction command </P> <P>| transaction ip, login, city</P> <P>but I don`t find out how to calculate custom fileds separately for each transaction.</P> <P>Also, I was looking at stats command, but as I understood, it`s not possible to use eval command inside stats statement. </P> <P>What`s the best way to do it?</P> Thu, 07 Mar 2013 15:24:51 GMT https://community.splunk.com/t5/Splunk-Search/Calculating-fields-by-groups-of-events/m-p/54699#M13338 andrey2007 2013-03-07T15:24:51Z https://community.splunk.com/t5/Splunk-Search/Calculating-fields-by-groups-of-events/m-p/54700#M13339 <P>You could do something like this for your two examples:</P> <PRE><CODE>... | eventstats count(eval(field4==5)) as result by ip login city ... | eventstats min(eval(if(field4==12,fieldn,null))) as min by ip login city </CODE></PRE> Fri, 08 Mar 2013 09:32:08 GMT https://community.splunk.com/t5/Splunk-Search/Calculating-fields-by-groups-of-events/m-p/54700#M13339 martin_mueller 2013-03-08T09:32:08Z https://community.splunk.com/t5/Splunk-Search/Calculating-fields-by-groups-of-events/m-p/54701#M13340 <P>i made without transaction command<BR /> 1st report<BR /> ...|where field4==12 | stats min(fieldn) by ip, login, city<BR /> 2nd report<BR /> ...|where field4==5 | stats count(field4) by ip, login, city<BR /> but i need it all in one united report</P> Mon, 11 Mar 2013 16:24:26 GMT https://community.splunk.com/t5/Splunk-Search/Calculating-fields-by-groups-of-events/m-p/54701#M13340 andrey2007 2013-03-11T16:24:26Z