Splunk Search

Loop through a particular field counting how many values there are for each value of said field

trc29
Engager

Hello all!

I feel like this is a simple query and I just can't wrap my head around it. The data I'm searching through has a field named "SenderAddress". This is an email address. I want to take each unique email address and count how many instances there are of it.

For example, lets see I have three email address in the source data: test1@gmail.com, myemail@hotmail.com, qwerty@gmail.com.

test1 has sent 10 emails so it appears 10 times
myemail has sent 1 email so it will appear only once
qwerty has sent 3 emails, appearing three times

I want the results to come out as follows:
test1@gmail.com - 10
myemail - 1
qwerty - 3

For the life of me I cannot figure out this syntax. Any help is greatly appreciated!

Tags (1)
0 Karma
1 Solution

maciep
Champion

I think you want to use stats here...

.... | stats count by SenderAddress

In general, getting out of the mindset of manually looping through results will be helpful. Commands like stats, chart, timechart, etc. will handle that for you. Or when piping to a command like eval, Splunk is looping through all of the results and applying the command to each.

You'll feel like you're losing some control if coming from a programming/scripting background, but it's nice to let Splunk do some of that for you.

View solution in original post

trc29
Engager

Works perfectly. I am having a hard time wrapping my head around the way I process data in splunk with some things but I'll get there. I just want to write a for each loop lol.

Thanks again

0 Karma

maciep
Champion

one day it clicked for me, so i'd say hang in there. Now i think of searching data more like a puzzle - i know what i'm starting with, i know what i want to end with, and i know the commands i have to work with...now just figure out how to string the commands together to solve the puzzle.

0 Karma

maciep
Champion

I think you want to use stats here...

.... | stats count by SenderAddress

In general, getting out of the mindset of manually looping through results will be helpful. Commands like stats, chart, timechart, etc. will handle that for you. Or when piping to a command like eval, Splunk is looping through all of the results and applying the command to each.

You'll feel like you're losing some control if coming from a programming/scripting background, but it's nice to let Splunk do some of that for you.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...