topic Re: How to count stats for two different field logs coming from the same device by using the OR command? in Splunk Search

How to count stats for two different field logs coming from the same device by using the OR command?

aqudoos — Fri, 06 Apr 2018 11:20:05 GMT

I have two different fields in logs coming from the same device. I want to count that stats for both fields by using the OR command but it's not running.

Following is the command:

|stats count by (Source-IP OR source_ip )

Source-ip and source_ip are two different fields

Re: How to count stats for two different field logs coming from the same device by using the OR command?

FrankVl — Fri, 06 Apr 2018 13:00:14 GMT

Rename one of the fields to match the name of the other, before doing the stats, so for example:

| rename Source-IP AS source_ip
| stats count by source_ip

Re: How to count stats for two different field logs coming from the same device by using the OR command?

richgalloway — Fri, 06 Apr 2018 13:08:10 GMT

One can't use OR in that context. Use a separate eval to establish the by field. For example,

| eval src_ip = coalesce(Source-IP, source_IP) | stats count by src_ip

Re: How to count stats for two different field logs coming from the same device by using the OR command?

aqudoos — Fri, 06 Apr 2018 13:21:13 GMT

Thanks!!!!

Re: How to count stats for two different field logs coming from the same device by using the OR command?

aqudoos — Fri, 06 Apr 2018 13:21:23 GMT

Thanks!!!!

Re: How to count stats for two different field logs coming from the same device by using the OR command?

krishnab — Sat, 07 Apr 2018 10:36:11 GMT

Also you can get by segregating the data only from those two sources

index=* source=a OR source=b
|stats count by source

Re: How to count stats for two different field logs coming from the same device by using the OR command?

FrankVl — Mon, 09 Apr 2018 07:44:59 GMT

I downvoted this post because he wants to count by source_ip field. splunk's 'source' metadata field has nothing to do with that.