topic How to achieve distinct count across multiple fields? in Splunk Search

How to achieve distinct count across multiple fields?

robert2138 — Thu, 15 Jun 2023 21:46:21 GMT

How to get a distinct count across two different fields. I have webserver request logs containing browser family and IP address – so should be able to get a count of different & distinct user-browsers by browser family – i.e. how many different users are using Safari for example. But piping into:

stats dc(ua_family,cp_ip) by ua_family

… doesn’t do it - I get a distinct list of browser families but zero counts. But concatenating the fields:

eval comb=c_ip.ua_family | stats dc(comb) by ua_family

…does work. Is there a way to do it without concatenating?
So why didn’t the dc on the two separate fields work?

Re: Distinct count across multiple fields

linu1988 — Mon, 28 Sep 2020 14:15:27 GMT

May be dc doesn't work on multiple fields..

you can get it like this:
| stats distinct_count(ua_family) ua_ip dd by ua_family,cp_ip|stats count(ua_ip)

Re: Distinct count across multiple fields

gkanapathy — Thu, 04 Jul 2013 19:49:28 GMT

i am not actually sure what you are asking to count, but either ... | stats dc(c_ip) by ua_family or ... | stats count by ua_family,c_ip may be what you want. if not, perhaps you could clarify as i don't think i understand what you're looking for.

Re: Distinct count across multiple fields

gfuente — Fri, 05 Jul 2013 06:55:13 GMT

Hello

You could use dedup to get only 1 event per combination of user agent and ip and then make a regular count:

... | dedup ua_family cp_ip | stats count

Regards

Re: Distinct count across multiple fields

weezeee — Wed, 28 Sep 2016 11:33:54 GMT

Not sure if it helps but in my case, I have some stats that require me to look at combination of clients services, and the intersection (some clients are using some services, but not others). I needed to do some stats for distinct client, service, and the client-service contracts. My raw data already have the field of each transaction with name of the client and service they have. I can get that by creating a new field, CONTRACT, which is simply a concatenation of client and service, then I can do a distinct count on it:

| stats count by CLIENT SERVICE | eval CONTRACT = CLIENT . "-" . SERVICE | stats dc(SERVICE) dc(CLIENT) dc(CONTRACT)

Re: Distinct count across multiple fields

nick405060 — Thu, 23 Jan 2020 23:39:53 GMT

Credit goes to @micahkemp:

| stats dc(eval(mvappend(field1, field2, field3)))