Splunk Enterprise Security

Is it possible to count the number of values in a field by another field without stats?

Explorer

I have a search where I am trying to determine if a sender is a threat based on several different events that are added up at the end of my search. Before that though im trying to determine how many people that a sender has sent a message too. So far ive tried mvcount but it looks like mvcount doesnt allow a count by another value. Thanks in advance.

0 Karma

Esteemed Legend

It appears that you posted this same question twice, is this one a duplicate of this one:
https://answers.splunk.com/answers/740480/how-to-compare-characters-in-two-fields-and-return.html#an...

If so, you should delete this one, because the other answer is more specific and has an accepted answer.

0 Karma

Esteemed Legend

Please respond @brienhawker.

0 Karma

SplunkTrust
SplunkTrust

you can use the eventstats command, read here:
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Eventstats

try this search anywhere, i hope it explains it well:

| makeresults count=5
| eval sender = "badguy,goodguy,neutralguy"
| makemv delim="," sender
| mvexpand sender
| eval recipients = case(sender=="badguy","1;;;2;;;3;;;4;;;5",sender=="neutralguy","1;;;2;;;3",sender=="goodguy","1")
| makemv delim=";;;" recipients
| mvexpand recipients
| eval message = "random message"
| eventstats dc(recipients) as unique_recipients by sender
0 Karma

Splunk Employee
Splunk Employee

Can you say more about why you don't want to use stats? Can you share an example search? Have you looked at other commands like chart or eventstats?

Explorer

Your eventstats recommendation worked. Thank you.

0 Karma

Explorer

Im not wanting to use stats because im needing to just count the number of recipients by sender mid search and from what ive tried I havent had much success from it. Im completly open if there is a way to do it.

0 Karma