topic Re: stats on the presence of a field in Splunk Search

stats on the presence of a field

Samslara — Tue, 29 Nov 2011 00:58:53 GMT

Hi,
I have a set of splunk entries where it can be one of several pattern of fields. So for example:

2011-01-01T12:00:00.000-0800 a=1 b=2
2011-01-01T12:00:00.001-0800 a=1 b=2
2011-01-01T12:00:00.002-0800 c=10
2011-01-01T12:00:00.003-0800 c=10
2011-01-01T12:00:00.004-0800 c=10
2011-01-01T12:00:00.005-0800 d=99

So with the above data I want to get the count of the presence of a field. So the output of such a query would be something like this:

fields | count
a | 2
b | 2
c | 3
d | 1

Can anyone suggest a query for me to use to do this?

Re: stats on the presence of a field

Ayn — Tue, 29 Nov 2011 07:54:29 GMT

Is it important to have the results in columns rather than rows?

You could do

... | stats count(a),count(b),count(c),count(d)

which will give you a count of each field in a new column. If you want it in rows instead, as in your example, use transpose:

... | stats count(a),count(b),count(c),count(d) | transpose

Re: stats on the presence of a field

Samslara — Tue, 29 Nov 2011 20:21:17 GMT

This would work if I knew all the fields that would be present, but suppose I didn't know. Is there a way to do this?

Re: stats on the presence of a field

_d_ — Tue, 29 Nov 2011 20:47:05 GMT

The best you can do given your requirement of not knowing the fields ahead of time is:

... | stats count(*) | transpose

This will give you a count of ALL fields present in the search.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

Re: stats on the presence of a field

Ayn — Tue, 29 Nov 2011 21:05:26 GMT

Just use wildcards:

... | stats count(*)

Re: stats on the presence of a field

Samslara — Tue, 29 Nov 2011 21:45:15 GMT

Thanks, this was very helpful.

Re: stats on the presence of a field

Samslara — Tue, 29 Nov 2011 21:48:30 GMT

Thank you.

Re: stats on the presence of a field

Samslara — Mon, 28 Sep 2020 10:09:50 GMT

One way I was going about it was to use rex:

... | rex field=_raw "\t(?[^=]+)=\d+\t" max_match=10 | stats count by myFields

Though this isn't as general as the accepted answer nor probably as fast.