Splunk Enterprise

count two fields by their (not necessarily common) values

petreb
Path Finder

Hello,

I have the following table

itemattributefirst_seenlast_seen
item1attr101.01.197001.01.2000
item2attr201.01.197001.01.2020
item3attr301.01.202101.01.2021

 

and I would like to count the last two fields based on their value (as in the table below). 

datecount(first_seen)count(last_seen)
01.01.197020
01.01.200001
01.01.202001
01.01.202111

 

I have tried to achieve this by using two searches and appending them, but I'm stuck at grouping them by date, which is a value of the 2 fields which can be common or not.

 

 

 

..........
| stats count by last_seen
| append [
..........
| stats count by first_seen]

 

 

gives me the table below, which is a step forward, but far from what I need

last_seencountfirst_seen
01.01.19700 
01.01.20001 
01.01.20201 
01.01.20211 
 201.01.1970
 001.01.2000
 001.01.2020
 101.01.2021

 

can anyone give me a hint?

cheers 

Labels (1)
Tags (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @petreb,

Please try below;

..........
| stats count as count_last by last_seen
| append [
..........
| stats count as count_first by first_seen]
| rename last_seen as date, first_seen as date
| stats list(count_first) as count(last_seen) list(count_last) as count(first_seen) by date
If this reply helps you an upvote and "Accept as Solution" is appreciated.

petreb
Path Finder

isn't what I needed (the last column is still empty), but gave me other ideas which kind of solved my problem 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...