topic stats count by variable field names? in Splunk Search

stats count by variable field names?

the_wolverine — Wed, 22 Feb 2017 01:03:28 GMT

I have a need to stats count by a list of variable fields that I don't know the names of. (stats count by * doesn't seem to work). Does anyone have any ideas?

I know I would need to fillnull the empty fields then stats count by (list of all fields). This is a reduced set already so I'm not actually fill nulling.

Re: stats count by variable field names?

jkat54 — Wed, 22 Feb 2017 02:12:26 GMT

How about

 stats count(*) by *

? I forget if that's he workaround or not been a moment for me.

Re: stats count by variable field names?

woodcock — Wed, 22 Feb 2017 03:57:36 GMT

I am taking you VERY literally so it is quite possible that this is not what you are really seeking. In order for this solution to work, you need 1 "real" field that you need to keep; I will assume that host is that field for you.. If there are more fields, then you will have to combine them so that you only have 1. For example, if you would like to keep sourcetype, too, then do this first (and use host_sourcetype instead of host in the last search):

... | eval host_sourcetype = host . "::" . sourcetype | fields - host sourcetype

Now that you only have 1 "keeper" field and then the "various" fields (make sure that you get rid of any other fields by using fields - list of other fields here), you do this:

| untable host various value
| stats sum(*) count(*) list(*) by host various