Archive

Count of values by sourcetype

Explorer

This should be pretty simple, but I seem to lack the right terms to find my answer:

We have several source types with a field "user". All I would like to return is a table where users are the rows, sourcetypes are the columns and the values are the number of events a user appears in that source type.

So if it were a CSV, it'd look like

user,firewall-logs,linux-logs,windows-logs
bob,4,2,4
nancy,8,1,3
eve,0,4,2

A totals column at the end would be great, but I can live with out it.

Tags (1)
0 Karma

Explorer

I found what I was looking for,

(search) | chart count over user by sourcetype

Thanks!

0 Karma

SplunkTrust
SplunkTrust

| addtotals

0 Karma

Legend

@mpuckettsc... Please accept DalJeanis answer as that is the complete answer you were looking for, addtotals will add Total of numeric fields as final column.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Legend

Please try the following:

<Your Base Search>
| chart count over user by sourcetype
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust
| makeresults
| eval mydata="Bob,firewall-logs,4 Bob,linux-logs,2 Bob,windows-logs,4 Nancy,firewall-logs,8 Nancy,linux-logs,1 Nancy,windows-logs,3 Eve,linux-logs,4 Eve,windows-logs,2"
| makemv mydata 
| mvexpand mydata
| rex field=mydata "(?[^,]+),(?[^,]+),(?.+)"
| table user sourcetype thecount
| rename COMMENT as "The above just produces test data as if you had done |stats count as thecount by user sourcetype" 

| chart sum(thecount) as count over user by sourcetype
| addtotals
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!