topic Re: Count values of grouped key in Splunk Search

Count values of grouped key

dav_muel — Thu, 15 Oct 2020 13:14:21 GMT

I have logs like this:

user=userA ip=1.1.1.1 ...
user=userA ip=1.1.1.2 ...
user=userB ip=1.1.2.1 ...
user=userB ip=1.1.2.1 ...
user=userC ip=1.1.3.1 ...
user=userC ip=1.1.3.2 ...
user=userC ip=1.1.3.3 ...

Now I want to have a list of all users with their IPs and the count of the different IPs.

First I do this:

======
search foobar
| stats values(user) by ip
======

Result is:

userA	1.1.1.1 1.1.1.2
userB	1.1.2.1
userC	1.1.3.1 1.1.3.2 1.1.3.3

How do I count and display the IPs? It should look like this:

userA	1.1.1.1 1.1.1.2	2
userB	1.1.2.1	1
userC	1.1.3.1 1.1.3.2 1.1.3.3	3

Re: Count values of grouped key

rnowitzki — Thu, 15 Oct 2020 13:33:00 GMT

Hi @dav_muel ,

This should work:

search foobar | stats values(ip) as ips by user | eval ipcount=mvcount(ips)

BR
Ralph

Re: Count values of grouped key

somesoni2 — Thu, 15 Oct 2020 13:40:56 GMT

You can call multiple function in stats. Like this

search foobar | stats values(ip) as ips_used dc(ips) as ips_count by user

Re: Count values of grouped key

inventsekar — Thu, 15 Oct 2020 13:50:23 GMT

base search | stats dc(ip) as IP_COUNT values(ip) as ip_list by User