Splunk Enterprise

How to find out how many times each log row appears in the log?

ilanaKarten0333
Observer

Hi. I have log with different messages.

I want to understand which line appears the most times in the log.
Please help me

 

Here you can see example to 4 lines from the log:

'2022-04-14 05:11:53,833',SmartX.ControlUp.Client.CacheActivityListener,'[Connections#12]','DEBUG','[OnDBTransaction] IsEntityInBlackList: Entity= Processes blackList is empty.'


'2022-04-14 05:11:53,833',SmartX.ControlUp.Client.AlertsFactory,'[Observables#18]','INFO','GetInvokedTrigger ShouldBeInvoked ==> Session, for trigger id = 3cb3a80e-0d64-4585-a255-9c554d534deb, trigger name = AAS_Session State - Active to Idle - BLK'


'2022-04-14 05:11:53,848',SmartX.ControlUp.Client.AlertsFactory,'[Observables#18]','DEBUG','ExamineAdvancedTriggersInternal - ret is true, trigger was added, trigger id = 3cb3a80e-0d64-4585-a255-9c554d534deb, trigger name = AAS_Session State - Active to Idle - BLK'


'2022-04-14 05:11:53,833',SmartX.ControlUp.Client.CacheActivityListener,'[Connections#12]','DEBUG','[OnDBTransaction] IsEntityInBlackList: Entity= Processes blackList is empty.'

I want receive statistic data about each raw how many times it appears in the log. Of course in my log are much more than 4 different lines

Labels (1)
0 Karma

Gr0und_Z3r0
Contributor

Hi @ilanaKarten0333 

You'll have to first identify the key field/entity to get your statistics of events.
For example, your key fields could be "trigger name" or "IsEntityInBlackList: Entity" as seen from the above logs.

Once you identify the field you are interested to view the events for, use the "stats" command to  get insights.
Example: | stats count by trigger_name

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...