group by field values

Splunkster45 — Thu, 18 Sep 2014 13:39:21 GMT

Hi! I'm a new user and have begun using this awesome tool. I've got a question about how to group things, below.
Suppose I have a log file that has 2 options for the field host: host-a, host-b and 2 different users. The users are turned into a field by using the rex filed=_raw command.

This command will tells how many times each user has logged on:

index=spss earliest=-25h  "Login succeeded for user" | rex field=_raw ".*Login succeeded for user: (?.*)" | stats count by user

This command will tells how many times each user has logged into each server

index=spss earliest=-25h  "Login succeeded for user" | rex field=_raw ".*Login succeeded for user: (?.*)" | stats count by user host

It gives an output that looks something like the following:

user..........host..........count

user1........host-a..........2

user2........host-b..........5

user2........host-a..........3

How can I modify the post to get a unique list of how many people have logged onto each host e.g.

host..........count

host-a............2

host-b............1

I essentially want to group by user, but am not sure of how to do that. Thanks in advance!

Re: group by field values

MuS — Thu, 18 Sep 2014 13:43:41 GMT

Welcome Splunkster45,

try this:

index=spss earliest=-25h  "Login succeeded for user" | rex field=_raw ".*Login succeeded for user: (?.*)" | stats count(user) AS count by host

hope this helps ...

cheers, MuS

topic group by field values in Splunk Search

group by field values

Re: group by field values