topic To find the count of specific fields in Splunk Search

To find the count of specific fields

Real_captain — Wed, 10 Apr 2024 10:13:47 GMT

Hi Team

I want to know if it is possible to find the count of specific fields and show them in different columns.

Example :

For the above example, i want the result in the below format:

|2024/04/10 | 49 | 38 | 5 | 6 |

Is it possible using a splunk query ?

Original query :

index=events_prod_cdp_penalty_esa source="SYSLOG"
(TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA))
| rex field=TEXT "NIDF=(?<file>[^\\s]+)"
| eval DIR = if(file="RPWARDA" ,"IN","OUT")
| convert timeformat="%Y/%m/%d" ctime(_time) AS Date
| stats count by Date , file , DIR

Re: To find the count of specific fields

scelikok — Wed, 10 Apr 2024 11:01:05 GMT

Hi @Real_captain,

You can try below;

index=events_prod_cdp_penalty_esa source="SYSLOG" (TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA)) | rex field=TEXT "NIDF=(?<file>[^\\s]+)" | convert timeformat="%Y/%m/%d" ctime(_time) AS Date | stats count(eval(file="RPWARDA")) AS RPWARDA, count(eval(file="SPWARAA")) AS SPWARAA, count(eval(file="SPWARRA")) AS SPWARRA by Date | eval Diff=(RPWARDA-(SPWARAA+SPWARRA))

Re: To find the count of specific fields

PickleRick — Wed, 10 Apr 2024 12:16:15 GMT

1. I don't see why you calculate the IN/OUT parameter if you don't need this value in the end.

2. Assuming you don't need the DIR field, you can simply use xyseries to... put your values into a x/y table.

| xyseries Date file count

Now you can just calculate your sum/difference of various files as you have them as separate fields. (you might have to fillnull with zero if you have blank spaces).