topic Re: how to extract total count for different fields in Splunk Search

how to extract total count for different fields

wkau — Wed, 06 Aug 2014 03:33:46 GMT

Hi, i will like to extract the count for the following

Data_no: 1T    
Identity: A  
Data_no: 2T  
Identity: C

i tried the following

| rex max_match= 0 "(?m) Data_no: (?<DataNo>[a-zA-Z0-9#]+)"  
| rex max_match= 0 "(?m) Identity: (?<Identity>[a-zA-Z0-9#]+)"   
| stats count(eval(Identity= "A")) as A, count(eval(Identity= "C")) as C by DataNo

The table returns the following:

DataNO| A | C  
1T    | 1 | 1  
2T    | 1 | 1

How to i filter it so that it will become like this:

DataNO| A | C  
1T    | 1 | 0  
2T    | 0 | 1

Thanks for your help!

Re: how to extract total count for different fields

strive — Mon, 28 Sep 2020 17:16:27 GMT

Data_no: 1T
Identity: A
Data_no: 2T
Identity: C

This is how your data is? If answer is no then can you post some sample log lines.

Re: how to extract total count for different fields

wkau — Wed, 06 Aug 2014 05:54:24 GMT

yup this is an example of how my data is!

Re: how to extract total count for different fields

strive — Wed, 06 Aug 2014 07:35:04 GMT

try this
|chart count by datano identity

Re: how to extract total count for different fields

wkau — Wed, 06 Aug 2014 08:03:45 GMT

after trying that i got A=1, C=1 for 1T and A=1, C=1 for 2T. i will need something like A=1,C=0 for 1T and A=0, C=1 for 2T

Re: how to extract total count for different fields

somesoni2 — Wed, 06 Aug 2014 13:05:11 GMT

Try this

Updated

your base search| rex max_match= 0 "(?m) Data_no: (?<DataNo>[a-zA-Z0-9#]+)"  
| rex max_match= 0 "(?m) Identity: (?<Identity>[a-zA-Z0-9#]+)" | eval temp=mvzip (DataNo, Identity) | mvexpand temp | rex field=temp "(?<DataNo>.*) (?<Identity>.*)"
| chart count over DataNo by Identity

Re: how to extract total count for different fields

wkau — Thu, 07 Aug 2014 01:06:25 GMT

I still got back the same results the data that is provided happens in the same event at the same time, is it possible to filter the DataNO and Identity individually so that it does not double count?

Re: how to extract total count for different fields

somesoni2 — Thu, 07 Aug 2014 03:43:16 GMT

Try updated answer.