https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168600#M186212 <P>Great. Thanks!</P> Fri, 28 Feb 2014 13:15:58 GMT a212830 2014-02-28T13:15:58Z https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168595#M186207 <P>Hi,</P> <P>How would I count a combination of fields in splunk? For example, I have a "from_ip_addr" and a "to_ip_addr" in an event, and I want to count unique combinations of those two. </P> Mon, 28 Sep 2020 15:59:50 GMT https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168595#M186207 a212830 2020-09-28T15:59:50Z https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168596#M186208 <P>Try this</P> <PRE><CODE>your base search | stats count by from_op_addr, to_ip_addr | stats count </CODE></PRE> Thu, 27 Feb 2014 16:06:15 GMT https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168596#M186208 somesoni2 2014-02-27T16:06:15Z https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168597#M186209 <P>Or this:</P> <PRE><CODE>your base search | eval from_to = from_ip_addr.to_ip_addr | stats dc(from_to) </CODE></PRE> Thu, 27 Feb 2014 16:21:44 GMT https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168597#M186209 martin_mueller 2014-02-27T16:21:44Z https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168598#M186210 <P>Thanks. Is there a way to get the combo's listed as well? </P> <P>from_ip to_ip count</P> Mon, 28 Sep 2020 16:00:03 GMT https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168598#M186210 a212830 2020-09-28T16:00:03Z https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168599#M186211 <P>Leave the final <CODE>stats</CODE> off the first suggestion to get this:</P> <PRE><CODE>your base search | stats count by from_op_addr, to_ip_addr </CODE></PRE> Thu, 27 Feb 2014 18:58:00 GMT https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168599#M186211 martin_mueller 2014-02-27T18:58:00Z https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168600#M186212 <P>Great. Thanks!</P> Fri, 28 Feb 2014 13:15:58 GMT https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168600#M186212 a212830 2014-02-28T13:15:58Z https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168601#M186213 <P>It works for me! Thanks.</P> Mon, 13 Nov 2017 02:15:52 GMT https://community.splunk.com/t5/Splunk-Search/counting-combination-of-fields/m-p/168601#M186213 sssignals 2017-11-13T02:15:52Z