https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82358#M20920 <P>"wdd-d{4}-d{6}" format?</P> <P>Yes.</P> Wed, 09 Jan 2013 17:31:51 GMT bigtyma 2013-01-09T17:31:51Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82355#M20917 <P><CODE>Title Position Security_Template<BR /> NonEE - Volunteer F01-7121-600002 IP VIEW ONLY CLINICAL<BR /> NonEE - Volunteer F01-7121-600002 FRONT DESK AND IP ORDERS CLERK<BR /> NonEE - Volunteer F01-7121-600002 IP VIEW ONLY CLINICAL<BR /> NonEE - Volunteer F01-7121-600002 IP VIEW ONLY CLINICAL<BR /> NonEE - Volunteer F01-7121-600002 ELINK VIEW-ONLY CLINICAL</CODE></P> <P>Using the example above, I would like to have a report listing the most frequent or most common value of 'Security_Template' for every Position. In the example above the most prevalent would be 'IP VIEW-ONLY' </P> <P>Bonus point is if we can list the percentage of records that have each value.</P> <P>Thank you!</P> Wed, 09 Jan 2013 16:47:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82355#M20917 bigtyma 2013-01-09T16:47:04Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82356#M20918 <P>The data is not easy to split into fields because of the number of spaces. Will the position column always be in the "\w\d\d-\d{4}-\d{6}" format?</P> Wed, 09 Jan 2013 16:53:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82356#M20918 alacercogitatus 2013-01-09T16:53:33Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82357#M20919 <P>You will need to extract the field first. Here is a quick example that might work:</P> <P>source = .... | rex field=_raw "-\d+\s+(?<SECURITY_TEMPLATE>[^\n]+) | stats count by Security_Template | sort -count</SECURITY_TEMPLATE></P> <P>If you want it by percentage then use the "top" search command. </P> <P>source = .... | rex field=_raw "-\d+\s+(?<SECURITY_TEMPLATE>[^\n]+) | top Security_Template</SECURITY_TEMPLATE></P> <P>If this is a CSV file with a header then you might be able to set the CHECK_FOR_HEADER in the props.conf file. Here is a link to more information:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Propsconf" target="_blank">http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Propsconf</A></P> Mon, 28 Sep 2020 13:04:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82357#M20919 tgow 2020-09-28T13:04:27Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82358#M20920 <P>"wdd-d{4}-d{6}" format?</P> <P>Yes.</P> Wed, 09 Jan 2013 17:31:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82358#M20920 bigtyma 2013-01-09T17:31:51Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82359#M20921 <P>Thank you for replying, unfortunately I did not get the results I was hoping for. Security_Template is already extracted.</P> <P>In this scenario I should see</P> <P>PositionID SecurityTemplate Percentage <BR /> F01-7121-600002 IP VIEW ONLY CLINICAL 50%</P> Wed, 09 Jan 2013 17:40:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82359#M20921 bigtyma 2013-01-09T17:40:35Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82360#M20922 <P>Thank you for replying, unfortunately I did not get the results I was hoping for. Security_Template is already extracted.</P> <P>In this scenario I should see</P> <P>PositionID SecurityTemplate Percentage <BR /> F01-7121-600002 IP VIEW ONLY CLINICAL 50%</P> Wed, 09 Jan 2013 17:40:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82360#M20922 bigtyma 2013-01-09T17:40:55Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82361#M20923 <P>If the field is already extracted then you can run the "top" command. Here is a quick example:</P> <P>source=... | top Security_Template, PositionID </P> Wed, 09 Jan 2013 18:41:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82361#M20923 tgow 2013-01-09T18:41:26Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82362#M20924 <P>woohoo! this works. I had to to change it slightly to ' | top Security_Template by PositionID</P> Wed, 09 Jan 2013 18:47:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-most-prevalent-values-for-a-field/m-p/82362#M20924 bigtyma 2013-01-09T18:47:55Z