How to group by the to= values, so I can count the number of times they repeat, create charts, and other metrics?

Stephcg — Thu, 12 Jan 2023 19:29:22 GMT

Hello!
I have many events, and I have a search that returns only the events that contain the to field.

index="my_index_qa" sourcetype="example-qa" to=*

The results are a list of events that have the following pattern:

db271cf8678c -2023-01-12 15:08:32.157 [app=app-name, traceId=traceid-value, spanId=spanid-value, INFO 1 [llEventLoop-5-5] filter.FilterBeingUsed : c=class, m=method, method=GET, to=http://example.url.com/path/extra, route=https://example.url.com/redirect/route, headers={X-Forwarded-For=[IPADDRESS, IPADDRESS2], X-Forwarded-Proto=[http], X-Forwarded-Port=[80], Host=[EXAMPLE-HOST], app-device=[DEVICE-INFO], app-user=[devicce-info-os-info], app-os=[APP-OS-VERSION], user-agent=[user-agent-example], app-version=[app.version.example], Origin=[origin-app]}

I want to be able to group by the to= values, so I can count the number of times they repeat, create charts and do some other metrics.

Is it possible? How can I do this?

Thank you for any help in advance. And sorry if I wrote anything wrong, english is not my main language.

Re: Grouping by URLs

richgalloway — Thu, 12 Jan 2023 19:25:35 GMT

Have you tried this?

index="my_index_qa" sourcetype="example-qa" to=* | stats count by to

Any time you want to count something, use stats (or eventstats or streamstats or timechart) count. Grouping by a field implies the by option.

Re: How to group by the to= values, so I can count the number of times they repeat, create charts, and other metrics?

Stephcg — Tue, 17 Jan 2023 16:13:45 GMT

That helped! Thank you a lot! 😊

topic Re: How to group by the to= values, so I can count the number of times they repeat, create charts, and other metrics? in Splunk Search

How to group by the to= values, so I can count the number of times they repeat, create charts, and other metrics?

Re: Grouping by URLs

Re: How to group by the to= values, so I can count the number of times they repeat, create charts, and other metrics?