Creating count by chart, but need additional field that only occurs once.

[mikelanghorst]

I'm trying to create a search to populate a chart with event count by conn number, but also include the value from the extracted field dn, which only occurs once per conn number.

Example data:

[07/Feb/2012:11:30:52 -0800] conn=1021540 op=-1 msgId=-1 - fd=107 slot=107 LDAP connection from 172.21.73.13 to 172.21.64.40
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=0 msgId=1 - BIND dn="uid=jbrown2,ou=people,o=domain,c=com" method=128 version=2
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=jbrown2,ou=people,o=domain,c=com"
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=1 msgId=2 - SRCH base="ou=people,o=domain,c=com" scope=2 filter="(|(uid=Kathy*User*)(cn=Kathy*User*))" attrs=ALL
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=2 msgId=3 - SRCH base="ou=groups,o=domain,c=com" scope=2 filter="(cn=Kathy*User*)" attrs="*"
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=2 msgId=3 - RESULT err=0 tag=101 nentries=0 etime=0
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=3 msgId=4 - SRCH base="cn=kathy User,ou=people,o=domain,c=com" scope=2 filter="(objectClass=*)" attrs=ALL
[07/Feb/2012:11:30:52 -0800] conn=1021540 op=3 msgId=4 - RESULT err=0 tag=101 nentries=1 etime=0
[07/Feb/2012:11:30:53 -0800] conn=1021540 op=4 msgId=5 - SRCH base="ou=groups,o=domain,c=com" scope=2 filter="(uniqueMember=cn=Kathy User, ou=People, o=domain, c=com)" attrs=ALL
[07/Feb/2012:11:30:53 -0800] conn=1021540 op=4 msgId=5 - RESULT err=0 tag=101 nentries=0 etime=0
[07/Feb/2012:11:30:53 -0800] conn=1021540 op=5 msgId=6 - UNBIND
[07/Feb/2012:11:30:53 -0800] conn=1021540 op=5 msgId=-1 - closing - U1
[07/Feb/2012:11:30:53 -0800] conn=1021540 op=-1 msgId=-1 - closed.

So, end results to be something like:
conn Count BIND dn

---

10035 305 uid=jbrown2,ou=people,o=domain,c=com
14842 5238 uid=my_app_account,ou=people,o=domain,c=com

[ayme · Accepted solution]

... | stats count, values(dn) by conn

[mikelanghorst]

Thanks, now just need to fix or create a new field extraction since there's more dn= than I'd expected in the data.

[sid19920]

How can you calculate search count by dn above and create a time chart??