Splunk Enterprise

How to get total number of Count?

Kirthika
Path Finder

 

Device_ID Handset_ID
1 Serial Number
1 Started
1 1420
1 1420
1 1420
1 Serial Number
1 Started
1 1420
1 Serial Number
1 Started
1 1420
1 1420
1 1420
1 Serial Number
1 Started
1 Serial Number
1 Started
2 1420
2 1420
2 Serial Number
2 Started
2 Serial Number
2 Started
2 Serial Number
2 Started
2 20
2 Serial Number
2 Started
2 Serial Number
2 Started

 

Expected Output: Count should be based on keyword "Serial Number"  followed by Handset_ID to another "Serial Number". If there is no Handset_ID between , it should skip the rows. Eg.last 4 rows

Handset_ID Total Count
1420 4
20 1
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where Handset_ID == "Serial Number" OR match(Handset_ID, "\d+")
| autoregress Handset_ID
| where Handset_ID_p1 == "Serial Number" AND match(Handset_ID, "\d+")
| stats count by Handset_ID

Kirthika
Path Finder

Thanks. Its working

Tags (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Kirthika,

You can try below;

| autoregress Handset_ID
| search Handset_ID_p1="Started" Handset_ID!="Serial Number"
| stats count by Handset_ID
If this reply helps you an upvote and "Accept as Solution" is appreciated.

Kirthika
Path Finder

Hi,

 

Thanks for your reply. Its working

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...