topic Re: Stats count for multiple fields in search in Splunk Search

Stats count for multiple fields in search

rockybhai — Tue, 29 Sep 2020 00:39:21 GMT

I have a query that has multiple states represented in each log event how do i get stats based on the state values my logs look like this

event 1 : x=true, y=true, z=false

event 2 : x=false, y=false, z=true

event 3: x=true, y= false, z=true

i want track all the scenarios where the values are true for these stages(x, y, z) like.

base_search AND (x=true or y=true or z=true) | stats count by x, y, z

state	count
x	2
y	1
z	2

Is this possible to chart or do i have to log each state individually ?

Re: Stats count for multiple fields in search

bowesmana — Tue, 29 Sep 2020 00:32:02 GMT

Here's an example - the first part sets up your dataset, then shows how to use stats.

Hope this helps

Re: Stats count for multiple fields in search

rockybhai — Tue, 29 Sep 2020 00:54:16 GMT

Each log statement contains only one reference to x,y,z. In your example i see you have loaded all the various states into one string. This will be represented as three messages in my case.

_raw;"setup x=true, y=false, z=false"
_raw: "setup x=true, y=true, z=false"

so when i search for setup i can get all these logs but not sure how to table these values.

Re: Stats count for multiple fields in search

bowesmana — Tue, 29 Sep 2020 01:59:12 GMT

The example shows 3 events, this is the part that sets up exactly the data you posted in your original post

| makeresults | eval _raw="x,y,z true,true,false false,false,true true,false,true" | multikv forceheader=1 | table x y z

and if you run this on its own, you get 3 events, as you posted.

So, the part you need is the stats part