Getting top values from two fields

kennethp — Mon, 23 Dec 2013 12:40:42 GMT

I have a index that contains both destination and source countries in each entry.
I would like to get a list over top 10 countries, regardless of the source or destination.

I have tried something like this:

... | top limit=10 srccountry,dstcountry

But this doesnt work, since it shows top based on both source and destination.

Something like this I was hoping would work, but clearly doesnt

... | top limit=10 srccountry OR dstcountry

I was thinking that I could add the results from two searches and addning them, but not sure how to do this.

Does anybody knows how to solve this? (if possible)

Re: Getting top values from two fields

martin_mueller — Mon, 23 Dec 2013 17:12:15 GMT

You could do something like this:

your search | eval country = srccountry . ";" . dstcountry | makemv delim=";" country | mvexpand country | top country

That will make two events for each event, one with country=srccountry and one with country=dstcountry, and then count the top ten countries.

topic Getting top values from two fields in Splunk Search

Getting top values from two fields

Re: Getting top values from two fields