Splunk Enterprise

How to find out how many times each log row appears in the log?

ilanaKarten0333
Observer

Hi. I have log with different messages.

I want to understand which line appears the most times in the log.
Please help me

 

Here you can see example to 4 lines from the log:

'2022-04-14 05:11:53,833',SmartX.ControlUp.Client.CacheActivityListener,'[Connections#12]','DEBUG','[OnDBTransaction] IsEntityInBlackList: Entity= Processes blackList is empty.'


'2022-04-14 05:11:53,833',SmartX.ControlUp.Client.AlertsFactory,'[Observables#18]','INFO','GetInvokedTrigger ShouldBeInvoked ==> Session, for trigger id = 3cb3a80e-0d64-4585-a255-9c554d534deb, trigger name = AAS_Session State - Active to Idle - BLK'


'2022-04-14 05:11:53,848',SmartX.ControlUp.Client.AlertsFactory,'[Observables#18]','DEBUG','ExamineAdvancedTriggersInternal - ret is true, trigger was added, trigger id = 3cb3a80e-0d64-4585-a255-9c554d534deb, trigger name = AAS_Session State - Active to Idle - BLK'


'2022-04-14 05:11:53,833',SmartX.ControlUp.Client.CacheActivityListener,'[Connections#12]','DEBUG','[OnDBTransaction] IsEntityInBlackList: Entity= Processes blackList is empty.'

I want receive statistic data about each raw how many times it appears in the log. Of course in my log are much more than 4 different lines

Labels (1)
0 Karma

Gr0und_Z3r0
Contributor

Hi @ilanaKarten0333 

You'll have to first identify the key field/entity to get your statistics of events.
For example, your key fields could be "trigger name" or "IsEntityInBlackList: Entity" as seen from the above logs.

Once you identify the field you are interested to view the events for, use the "stats" command to  get insights.
Example: | stats count by trigger_name

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...