topic Combining values across multiple fields in an event in Splunk Search

Combining values across multiple fields in an event

jstockamp — Thu, 02 Jun 2011 23:34:49 GMT

I've got a bunch of similar fields in my events. I've got fields named term0-9 and I'd like to create a chart that shows the top terms across all those fields.

For example, if I have an event where term0="First+Term" and term1="Second+Term"

Event #    term0    term1     term2
-------    -----    -----     -----
1          Bob      Mary      John
2          Mary     Jake      Tim
3          Bill     Tom       Sally
4          Sam      Sally     Mary

I'd like to output a chart that shows:

Term           Searches
----           --------
Mary           3
Sally          2
Bob            1
John           1
Jake           1
Tim            1
Bill           1
Tom            1
etc .......

Is this possible. If I just combine the fields into one and group based on that, then the order of the search term becomes significant and I don't want it to be.

Anyone have any ideas?

Re: Combining values across multiple fields in an event

mkashif — Fri, 03 Jun 2011 06:45:24 GMT

Hello,

you can achieve your objective using top command and count by command

Re: Combining values across multiple fields in an event

jstockamp — Fri, 03 Jun 2011 14:48:19 GMT

Care to give a little more details on your suggestion? How do I do this across multiple fields?

I can do

top 20 term0

but I don't know how to have it evaluate multiple fields. Thoughts?