<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to compare 5 different fields and get the count of their occurrence in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-compare-5-different-fields-and-get-the-count-of-their/m-p/550339#M156170</link>
    <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227232"&gt;@aaa2324&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;try this.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;YOUR_SEARCh | stats count by category code  text  country  org&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Sample:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults | eval _raw="category	code	text	country	org
abc	100	Adv	US	12
abc	100	Adv	US	12
abc	100	Agh	Eu	13
abc	100	Agh	Eu	13"
| multikv forceheader=1
| table category code  text  country  org
| stats count by category code  text  country  org&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Tue, 04 May 2021 07:16:49 GMT</pubDate>
    <dc:creator>kamlesh_vaghela</dc:creator>
    <dc:date>2021-05-04T07:16:49Z</dc:date>
    <item>
      <title>How to compare 5 different fields and get the count of their occurrence</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-compare-5-different-fields-and-get-the-count-of-their/m-p/550338#M156169</link>
      <description>&lt;P&gt;Hi Team,&lt;/P&gt;&lt;P&gt;I would like to compare below 5 different columns and get one more column as a count.&lt;/P&gt;&lt;P&gt;category code &amp;nbsp;text &amp;nbsp;country &amp;nbsp;org&lt;/P&gt;&lt;P&gt;abc &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; 100 &amp;nbsp; &amp;nbsp; &amp;nbsp;Adv &amp;nbsp; &amp;nbsp;US &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;12&lt;/P&gt;&lt;P&gt;abc &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;100 &amp;nbsp; &amp;nbsp; Adv &amp;nbsp; &amp;nbsp;US &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; 12&lt;/P&gt;&lt;P&gt;abc &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; 100 &amp;nbsp; &amp;nbsp; Agh &amp;nbsp; &amp;nbsp;Eu &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; 13&lt;/P&gt;&lt;P&gt;abc &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; 100 &amp;nbsp; &amp;nbsp; Agh &amp;nbsp; &amp;nbsp;Eu &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; 13&lt;/P&gt;&lt;P&gt;Column count should have have the number of times of occurrence of the below, say first 2 entries are occurring 2 time so it should display the output as&lt;/P&gt;&lt;P&gt;category code &amp;nbsp;text &amp;nbsp;country &amp;nbsp;org &amp;nbsp; Count&lt;/P&gt;&lt;P&gt;abc &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; 100 &amp;nbsp; &amp;nbsp; &amp;nbsp;Adv &amp;nbsp; &amp;nbsp;US &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;12 &amp;nbsp; &amp;nbsp; &amp;nbsp; 2&lt;/P&gt;&lt;P&gt;kindly help with the query to achieve this.&lt;/P&gt;</description>
      <pubDate>Tue, 04 May 2021 07:07:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-compare-5-different-fields-and-get-the-count-of-their/m-p/550338#M156169</guid>
      <dc:creator>aaa2324</dc:creator>
      <dc:date>2021-05-04T07:07:33Z</dc:date>
    </item>
    <item>
      <title>Re: How to compare 5 different fields and get the count of their occurrence</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-compare-5-different-fields-and-get-the-count-of-their/m-p/550339#M156170</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227232"&gt;@aaa2324&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;try this.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;YOUR_SEARCh | stats count by category code  text  country  org&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Sample:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults | eval _raw="category	code	text	country	org
abc	100	Adv	US	12
abc	100	Adv	US	12
abc	100	Agh	Eu	13
abc	100	Agh	Eu	13"
| multikv forceheader=1
| table category code  text  country  org
| stats count by category code  text  country  org&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 04 May 2021 07:16:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-compare-5-different-fields-and-get-the-count-of-their/m-p/550339#M156170</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2021-05-04T07:16:49Z</dc:date>
    </item>
    <item>
      <title>Re: How to compare 5 different fields and get the count of their occurrence</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-compare-5-different-fields-and-get-the-count-of-their/m-p/550399#M156191</link>
      <description>&lt;P&gt;Thanks but this is giving me the results as count below.&lt;/P&gt;&lt;P&gt;abc &amp;nbsp; &amp;nbsp; 100 &amp;nbsp; &amp;nbsp; Adv &amp;nbsp; &amp;nbsp;US &amp;nbsp; 1&lt;/P&gt;&lt;P&gt;but I want the result to have count as 2 since it is occurring twice.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;kindly advise&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 04 May 2021 13:23:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-compare-5-different-fields-and-get-the-count-of-their/m-p/550399#M156191</guid>
      <dc:creator>aaa2324</dc:creator>
      <dc:date>2021-05-04T13:23:21Z</dc:date>
    </item>
    <item>
      <title>Re: How to compare 5 different fields and get the count of their occurrence</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-compare-5-different-fields-and-get-the-count-of-their/m-p/550404#M156194</link>
      <description>&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2021-05-04 at 7.10.20 PM.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/14033iBDB493BD5CC344AB/image-size/medium?v=v2&amp;amp;px=400" role="button" title="Screenshot 2021-05-04 at 7.10.20 PM.png" alt="Screenshot 2021-05-04 at 7.10.20 PM.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt; It's giving 2 as count. can you please share your sample search ?&lt;/P&gt;</description>
      <pubDate>Tue, 04 May 2021 13:40:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-compare-5-different-fields-and-get-the-count-of-their/m-p/550404#M156194</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2021-05-04T13:40:54Z</dc:date>
    </item>
  </channel>
</rss>

