https://community.splunk.com/t5/Splunk-Search/How-to-count-the-the-number-of-elements-in-a-fields-after/m-p/181486#M52300 <P>Is this close enough?</P> <PRE><CODE> ... | eventstats mode(*) AS mode_* BY user | eval deviant_src=if((src==mode_src),null(),src) | eval deviant_dest=if((dest==mode_dest),null(),dest) | eval deviant_app=if((app==mode_app),null(),app) | stats values(deviant*) count(deviant*) BY user </CODE></PRE> Mon, 29 Jun 2015 15:44:41 GMT woodcock 2015-06-29T15:44:41Z https://community.splunk.com/t5/Splunk-Search/How-to-count-the-the-number-of-elements-in-a-fields-after/m-p/181484#M52298 <P>How could the number of elements in a tuple of fields be counted after performing a set difference against the other events?</P> <P>A trivial example:</P> <P>Fields: user, src, dest, app<BR /> EventA: (alice, host1, host3, sso)<BR /> EventB: (alice, host2, host3, sshd)<BR /> EventC: (alice, host1, host3, sshd)</P> <P>The set difference of EventA and the other two events above would be the set: (sso) with a count of 1.</P> <P>Using an imaginary stats function, it might look something like this:</P> <PRE><CODE>... | eventstats setdiff(src dest app) as difference by user | eval count=mvcount(difference) </CODE></PRE> Mon, 29 Jun 2015 11:15:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-the-the-number-of-elements-in-a-fields-after/m-p/181484#M52298 doksu 2015-06-29T11:15:31Z https://community.splunk.com/t5/Splunk-Search/How-to-count-the-the-number-of-elements-in-a-fields-after/m-p/181485#M52299 <P>Are you sure the answer to your example shouldn't be: (host2,sso)?</P> Mon, 29 Jun 2015 15:29:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-the-the-number-of-elements-in-a-fields-after/m-p/181485#M52299 woodcock 2015-06-29T15:29:22Z https://community.splunk.com/t5/Splunk-Search/How-to-count-the-the-number-of-elements-in-a-fields-after/m-p/181486#M52300 <P>Is this close enough?</P> <PRE><CODE> ... | eventstats mode(*) AS mode_* BY user | eval deviant_src=if((src==mode_src),null(),src) | eval deviant_dest=if((dest==mode_dest),null(),dest) | eval deviant_app=if((app==mode_app),null(),app) | stats values(deviant*) count(deviant*) BY user </CODE></PRE> Mon, 29 Jun 2015 15:44:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-the-the-number-of-elements-in-a-fields-after/m-p/181486#M52300 woodcock 2015-06-29T15:44:41Z https://community.splunk.com/t5/Splunk-Search/How-to-count-the-the-number-of-elements-in-a-fields-after/m-p/181487#M52301 <P>Thanks for your answer woodcock. It's quite close and a really interesting answer but it looks like it would only apply the operation to the most common element for each field. Maybe I should submit an RFE?</P> Fri, 10 Jul 2015 10:24:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-the-the-number-of-elements-in-a-fields-after/m-p/181487#M52301 doksu 2015-07-10T10:24:59Z